Compilation results for pki1001.eqiad.wmnet: System changes detected

Catalog differences

Summary

Resources only in the new catalog

• File[/lib/systemd/system/prometheus-node-textfile-check-nft.service]
• File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft]
• Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.timer (prometheus-node-textfile-check-nft.timer)]
• File[/etc/nftables/input/10_full-monitoring-metrics-access-udp.nft]
• File[/etc/nftables/output]
• Nftables::Set[DOMAIN_NETWORKS]
• Nftables::Set[CUMIN_MASTERS]
• File[/etc/nftables/sets/INTERNAL_ipv6.nft]
• File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft]
• Nftables::Set[KAFKA_BROKERS_JUMBO]
• Nftables::Set[LABS_NETWORKS]
• File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft]
• Nftables::Set[CLOUD_PRIVATE_NETWORKS]
• File[/etc/nftables/postrouting]
• File[/etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft]
• Nftables::Set[KAFKAMON_HOSTS]
• File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft]
• Nftables::Service[full-monitoring-metrics-access-tcp]
• Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.service (prometheus-node-textfile-check-nft.service)]
• File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft]
• Nftables::Set[AUX_KUBEPODS_NETWORKS]
• Motd::Script[insetup::infrastructure_foundations_nftables]
• File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft]
• Nftables::Set[BASTION_HOSTS]
• Logrotate::Conf[prometheus-node-textfile-check-nft]
• Systemd::Unit[nftables]
• File[/etc/nftables/sets/MONITORING_HOSTS_ipv4.nft]
• Motd::Message[insetup::infrastructure_foundations_nftables]
• Prometheus::Node_textfile[check-nft]
• Exec[unmask_nftables.service]
• File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft]
• File[/etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft]
• Systemd::Syslog[prometheus-node-textfile-check-nft]
• File[/etc/nftables/100_base_puppet.nft]
• File[/etc/systemd/system/nftables.service.d/puppet-override.conf]
• File[/etc/nftables/sets/INTERNAL_ipv4.nft]
• File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft]
• File[/etc/nftables/sets/CUMIN_MASTERS_ipv6.nft]
• File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft]
• File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft]
• File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft]
• Nftables::Set[DSE_KUBEPODS_NETWORKS]
• Nftables::Set[MYSQL_ROOT_CLIENTS]
• Nftables::Service[full-monitoring-metrics-access-udp]
• Systemd::Timer::Job[prometheus-node-textfile-check-nft]
• File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/NETWORK_INFRA_ipv4.nft]
• Nftables::Set[PROMETHEUS_HOSTS]
• File[/etc/nftables/sets/NETWORK_INFRA_ipv6.nft]
• File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft]
• File[/etc/nftables/sets/LINK_LOCAL_ipv4.nft]
• Nftables::Set[INTERNAL]
• File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft]
• File[/lib/systemd/system/prometheus-node-textfile-check-nft.timer]
• File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/MONITORING_HOSTS_ipv6.nft]
• Nftables::Set[KAFKA_BROKERS_LOGGING]
• File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft]
• File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft]
• File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft]
• Systemd::Unmask[nftables.service]
• File[/etc/nftables/sets/INSTALL_HOSTS_ipv6.nft]
• Nftables::Set[CLOUD_NETWORKS]
• Nftables::Service[ssh-from-bastion]
• File[/etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft]
• Class[Nftables]
• Exec[systemd daemon-reload for nftables.service (nftables)]
• File[/etc/nftables/sets/LINK_LOCAL_ipv6.nft]
• File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft]
• Nftables::Set[WIKIKUBE_KUBEPODS_NETWORKS]
• File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft]
• File[/etc/nftables/sets/CACHES_ipv4.nft]
• Nftables::File[base]
• Nftables::Set[DRUID_PUBLIC_HOSTS]
• Rsyslog::Conf[prometheus-node-textfile-check-nft]
• Nftables::Set[CLOUD_NETWORKS_PUBLIC]
• Nftables::Set[MONITORING_HOSTS]
• Nftables::Set[MGMT_NETWORKS]
• File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft]
• File[/etc/nftables/sets]
• Nftables::Set[ZOOKEEPER_FLINK_HOSTS]
• File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft]
• File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft]
• Nftables::Set[STAGING_KUBEPODS_NETWORKS]
• Nftables::Set[NETWORK_INFRA]
• File[/etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft]
• File[/etc/logrotate.d/prometheus-node-textfile-check-nft]
• File[/etc/nftables/forward]
• Nftables::Set[FRACK_NETWORKS]
• Nftables::Service[ssh-from-cumin-masters]
• File[/etc/nftables/sets/LABS_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft]
• File[/etc/update-motd.d/05-insetup--infrastructure-foundations-nftables]
• File[/etc/nftables/sets/INSTALL_HOSTS_ipv4.nft]
• Nftables::Set[MLSERVE_KUBEPODS_NETWORKS]
• File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft]
• Nftables::Set[MW_APPSERVER_NETWORKS]
• Systemd::Unit[prometheus-node-textfile-check-nft.service]
• Nftables::Set[DEPLOYMENT_HOSTS]
• File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft]
• Package[nftables]
• File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft]
• File[/etc/nftables/prerouting]
• File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft]
• File[/etc/nftables/notrack]
• File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft]
• File[/etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/BASTION_HOSTS_ipv4.nft]
• Node[__node_regexp__pki1001.eqiad.]
• File[/etc/nftables/sets/BASTION_HOSTS_ipv6.nft]
• File[/etc/nftables/sets/MGMT_NETWORKS_ipv6.nft]
• File[/etc/nftables/]
• File[/etc/nftables/input/10_ssh-from-cumin-masters.nft]
• File[/etc/nftables/sets/CACHES_ipv6.nft]
• Nftables::Set[ZOOKEEPER_HOSTS_MAIN]
• File[/var/log/prometheus-node-textfile-check-nft]
• File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft]
• Systemd::Timer[prometheus-node-textfile-check-nft]
• File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft]
• File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft]
• File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft]
• Nftables::Set[SANDBOX_NETWORKS]
• File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft]
• File[/etc/nftables/input/10_ssh-from-bastion.nft]
• Nftables::Set[CACHES]
• File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft]
• Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS]
• Nftables::Set[PRODUCTION_NETWORKS]
• File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft]
• File[/etc/nftables.conf]
• File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft]
• Nftables::Set[LOAD_BALANCER_HEALTH_CHECKS]
• Nftables::Set[INSTALL_HOSTS]
• Systemd::Service[prometheus-node-textfile-check-nft]
• Nftables::Set[ANALYTICS_NETWORKS]
• File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft]
• File[/etc/nftables/input]
• Nftables::Set[LINK_LOCAL]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf]
• File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft]
• Service[nftables]
• File[/usr/local/bin/check-nft]
• File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft]
• Class[Profile::Firewall::Nftables_base_sets]
• File[/etc/nftables/sets/LABS_NETWORKS_ipv4.nft]
• File[/etc/nftables/sets/FRACK_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft]
• File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft]
• Nftables::Set[KAFKA_BROKERS_MAIN]
• Systemd::Service[nftables]
• File[/etc/systemd/system/nftables.service.d]
• File[/etc/nftables/main.nft]
• File[/etc/nftables/sets/CUMIN_MASTERS_ipv4.nft]
• Class[Role::Insetup::Infrastructure_foundations_nftables]
• File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft]
• Systemd::Unit[prometheus-node-textfile-check-nft.timer]
• Nftables::Set[LABSTORE_HOSTS]
• File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft]
• File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft]
• Service[prometheus-node-textfile-check-nft.timer]
• File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft]

Resources only in the old catalog

• Cfssl::Db[multirootca-db]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
• Systemd::Unit[cfssl-gc-expired-certs.timer]
• Exec[Generate initial CRL for zuul]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)]
• File[/etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy]
• Systemd::Syslog[cfssl-ocsprefresh-mlserve]
• Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]
• Service[cfssl-ocsprefresh-wikikube_front_proxy.timer]
• Rsyslog::Conf[cfssl-ocsprefresh-mlserve]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
• File[/etc/cfssl/signers/wikikube/ca/wikikube.pem]
• Service[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]
• Service[cfssl-ocspserve@zuul]
• Systemd::Syslog[wmf_auto_restart_ulogd2]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg]
• Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)]
• Prometheus::Blackbox::Check::Http[PKI_wikikube_staging_front_proxy]
• File[/etc/cfssl/signers/wikikube_staging/ca]
• Sudo::User[nrpe-check_check_certificate_expiry_mlserve]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
• File[/lib/systemd/system/cfssl-ocsprefresh-kafka.service]
• Systemd::Timer[cfssl-ocsprefresh-cassandra]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_debmonitor]
• Service[cfssl-ocspserve@puppet_rsa]
• Rsyslog::Conf[ulogd]
• Exec[Generate initial CRL for discovery]
• File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem]
• Ferm::Rule[filter_log_filter-bootp]
• Systemd::Service[cfssl-ocsprefresh-mlserve]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service]
• Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging_front_proxy]
• Prometheus::Alert::Rule[check_check_certificate_expiry_puppet_rsa_c1b324b3d8ac107f8d7483b4017f5edf]
• Prometheus::Alert::Rule[check_check_certificate_expiry_etcd_c834f873297e445663ead81279c0b928]
• Logrotate::Conf[cfssl-ocsprefresh-network_devices]
• File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.service]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)]
• File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp]
• Systemd::Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
• File[/usr/local/bin/prometheus-check-mlserve-certificate-expiry]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)]
• Systemd::Syslog[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
• Sudo::User[nrpe_certificate_check_etcd]
• Service[wmf_auto_restart_ulogd2.timer]
• Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]
• File[/etc/cfssl/signers/debmonitor/ca]
• Monitoring::Service[check_certificate_expiry_discovery2026]
• Nrpe::Plugin[check_ferm]
• File[/var/lib/prometheus/node.d/check_check_cfssl-multirootca_status.prom]
• Cfssl::Signer[cloud_wmnet_ca]
• Sudo::User[nrpe-check_check_certificate_expiry_cassandra]
• Rsyslog::Conf[cfssl-ocsprefresh-cassandra]
• Service[cfssl-ocspserve@aux]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)]
• File[/etc/cfssl/signers/cassandra/ca/cassandra-key.pem]
• Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux_front_proxy.prom]
• Systemd::Timer[cfssl-ocsprefresh-discovery2026]
• Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.timer]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux]
• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
• Sudo::User[nrpe_certificate_check_debmonitor]
• File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem]
• Systemd::Unit[cfssl-ocspserve@mlserve]
• Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
• File[/etc/cfssl/ocsp/mlserve_staging.ocsp]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]
• Systemd::Timer[cfssl-ocsprefresh-mlserve]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_syslog]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf]
• File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse_front_proxy.prom]
• Cfssl::Config[dse]
• Cfssl::Cert[OCSP_etcd_pki1001_eqiad_wmnet]
• File[/lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service]
• File[/lib/systemd/system/cfssl-ocspserve@network_devices.service]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]
• File[/srv/cfssl/bundles/cassandra.pem]
• Systemd::Syslog[cfssl-ocsprefresh-debmonitor]
• Logrotate::Conf[cfssl-ocsprefresh-zuul]
• File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem]
• Service[nrpe2nodexp-check_certificate_expiry_wikikube.timer]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]
• Nrpe::Check[check_check_certificate_expiry_aux_front_proxy]
• File[/usr/local/sbin/cfssl-ocsprefresh]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse]
• Ferm::Service[full_monitoring_metrics_access_tcp]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_debmonitor]
• Prometheus::Blackbox::Check::Http[PKI_network_devices]
• Systemd::Unit[cfssl-ocspserve@cassandra]
• File[/etc/apache2/mods-available/status.conf]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor]
• File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
• Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)]
• File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem]
• Systemd::Service[cfssl-ocsprefresh-kafka]
• Sudo::User[nrpe_certificate_check_dse]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026]
• Exec[Generate initial CRL for wikikube]
• Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_front_proxy_9d6dd05c8e5e1bb294462d932b24bd1a]
• Prometheus::Blackbox::Check::Http[PKI_mlserve_front_proxy]
• File[/etc/cfssl/signers/debmonitor/cfssl.conf]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf]
• Sudo::User[nrpe_certificate_check_zuul]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]
• File[/etc/cfssl/ocsp/zuul.ocsp]
• Cfssl::Ocsp[zuul]
• Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]
• Service[cfssl-ocsprefresh-discovery.timer]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_front_proxy]
• Systemd::Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
• Ferm::Rule[dscp-default]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf]
• Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_7cff186656c3cabbca85b5b57d0c8679]
• File[/etc/logrotate.d/cfssl-ocsprefresh-cassandra]
• Systemd::Override[apache2-after-network-online-target]
• Rsyslog::Conf[nrpe2nodexp-ferm_active]
• Systemd::Service[cfssl-ocsprefresh-mlserve_staging_front_proxy]
• Ferm::Conf[main]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]
• File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem]
• File[/lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service]
• File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem]
• File[/srv/cfssl/bundles/dse_front_proxy.pem]
• Cfssl::Cert[OCSP_puppet_rsa_pki1001_eqiad_wmnet]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf]
• File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
• File[/etc/cfssl/signers/aux_front_proxy/cfssl.conf]
• Cfssl::Cert[OCSP_wikikube_pki1001_eqiad_wmnet]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
• Systemd::Timer[cfssl-ocsprefresh-dse_front_proxy]
• Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_front_proxy_e515778a769f523fb98a7f642670e011]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
• Exec[Generate initial CRL for wikikube_front_proxy]
• Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]
• Cfssl::Config[kafka]
• Exec[renew certificate - OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
• Prometheus::Node_textfile[prometheus-check-wikikube_front_proxy-certificate-expiry]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg]
• Sudo::User[nrpe-check_check_cfssl-multirootca_status]
• Cfssl::Cert[OCSP_debmonitor_pki1001_eqiad_wmnet]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service]
• Systemd::Unit[cfssl-ocspserve@wikikube]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg]
• File[/etc/cfssl/signers/network_devices/ca]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube]
• File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_udp]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)]
• Sudo::User[nrpe_certificate_check_cloud_wmnet_ca]
• Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet]
• File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]
• Cfssl::Signer[aux]
• Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cassandra]
• Prometheus::Node_textfile[prometheus-check-syslog-certificate-expiry]
• Service[cfssl-ocsprefresh-dse_front_proxy.timer]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)]
• Prometheus::Blackbox::Check::Http[PKI_discovery]
• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)]
• File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.timer]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux]
• Systemd::Service[cfssl-ocspserve@mlserve_staging_front_proxy]
• Monitoring::Service[check_certificate_expiry_cassandra]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.timer]
• File[/srv/cfssl/bundles/Puppet_Internal_CA.pem.pem]
• File[/etc/cfssl/ocsp/aux.ocsp]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]
• Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_kafka]
• Systemd::Unit[wmf_auto_restart_apache2.timer]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
• Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging_front_proxy]
• Nrpe::Check[check_check_certificate_expiry_mlserve]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
• Cfssl::Cert[OCSP_cassandra_pki1001_eqiad_wmnet]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
• Sudo::User[nrpe-check_check_certificate_expiry_kafka]
• Exec[Generate cert puppet_rsa__pki_discovery_wmnet]
• File[/etc/cfssl/ocsp/wikikube.ocsp]
• Nrpe::Check[check_check_certificate_expiry_kafka]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
• Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery2026]
• File[/lib/systemd/system/cfssl-ocsprefresh-zuul.service]
• Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet refresh]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf]
• Nrpe::Check[check_check_certificate_expiry_mlserve_staging]
• Rsyslog::Conf[cfssl-gc-expired-certs]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve.prom]
• Service[cfssl-ocspserve@mlserve_front_proxy]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]
• File[/etc/sudoers.d/nrpe_certificate_check_syslog]
• Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet refresh]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]
• Package[ulogd2]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service]
• Package[python3-cryptography]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg]
• Sudo::User[nrpe-check_check_certificate_expiry_discovery2026]
• Monitoring::Service[check_certificate_expiry_puppet_rsa]
• Cfssl::Ocsp[network_devices]
• File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
• File[/srv/cfssl/bundles/etcd.pem]
• Prometheus::Alert::Rule[check_check_certificate_expiry_kafka_22922fd6bc2d570e018cbe5ccd8d1727]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]
• Httpd::Site[pki.discovery.wmnet]
• Nrpe::Check[check_check_certificate_expiry_aux]
• Logrotate::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]
• Cfssl::Config[cassandra]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)]
• File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
• File[/srv/cfssl/bundles/aux.pem]
• Systemd::Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
• Cfssl::Ocsp[mlserve_staging]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
• File[/etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
• File[/etc/cfssl/signers/network_devices/ca/network_devices-key.pem]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer]
• File[/etc/cfssl/signers/wikikube]
• Nrpe::Plugin[check_systemd_unit_status]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]
• File[/etc/sudoers.d/nrpe_certificate_check_puppet_rsa]
• Systemd::Service[cfssl-ocspserve@syslog]
• Systemd::Service[cfssl-ocspserve@wikikube_staging_front_proxy]
• Systemd::Timer::Job[cfssl-ocsprefresh-dse]
• File[/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem]
• Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf]
• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service]
• Prometheus::Node_textfile[prometheus-check-puppet_rsa-certificate-expiry]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging.prom]
• Exec[Generate initial CRL for syslog]
• Systemd::Syslog[cfssl-ocsprefresh-dse]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_network_devices]
• Profile::Pki::Multirootca::Monitoring[discovery]
• Cfssl::Ocsp[aux_front_proxy]
• File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.timer]
• Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet refresh]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_zuul]
• File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem]
• Nrpe::Check[check_check_certificate_expiry_dse_front_proxy]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
• Service[cfssl-ocspserve@cassandra]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
• Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry]
• File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem]
• File[/etc/cfssl/signers/discovery2026/ca]
• Exec[renew certificate - OCSP_dse_pki1001_eqiad_wmnet]
• File[/lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service]
• Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]
• File[/etc/logrotate.d/cfssl-gc-expired-certs]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
• Systemd::Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
• Sudo::User[nrpe_certificate_check_mlserve_staging]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
• File[/usr/local/bin/prometheus-check-network_devices-certificate-expiry]
• File[/etc/ssl/dhparam.pem]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery2026]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)]
• Systemd::Service[cfssl-ocspserve@cassandra]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery]
• Logrotate::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
• Rsyslog::Conf[cfssl-ocsprefresh-network_devices]
• Systemd::Service[cfssl-ocspserve@dse]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)]
• Prometheus::Alert::Rule[check_check_certificate_expiry_discovery_38e4dbcfd07ed60daf5bb89397abbe29]
• File[/usr/local/bin/prometheus-check-aux-certificate-expiry]
• Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging]
• Cfssl::Config[mlserve_front_proxy]
• Cfssl::Ocsp[Wikimedia_Internal_Root_CA]
• File[/etc/cfssl/ocsp/discovery.ocsp]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
• Rsyslog::Conf[cfssl-ocsprefresh-aux]
• File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
• Systemd::Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
• File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy]
• Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]
• Systemd::Syslog[ulogd]
• Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]
• File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem]
• File[/etc/apache2/sites-available]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]
• File[/etc/cfssl/signers/syslog/cfssl.conf]
• Cfssl::Signer[zuul]
• Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet]
• Package[apache2]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]
• Sudo::User[nrpe_certificate_check_wikikube_staging]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]
• File[/etc/cfssl/signers/cloud_wmnet_ca]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg]
• File[/etc/cfssl/ocsp/dse_front_proxy.ocsp]
• File[/etc/cfssl/signers/wikikube/ca]
• Nrpe::Monitor_service[check_certificate_expiry_dse]
• File[/etc/cfssl/signers/kafka/ca/kafka-key.pem]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.timer]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf]
• Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet refresh]
• File[/etc/cfssl/signers/aux/ca]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service]
• File[/etc/cfssl/ocsp/wikikube_front_proxy.ocsp]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]
• Exec[renew certificate - OCSP_debmonitor_pki1001_eqiad_wmnet]
• Nrpe::Monitor_service[check_certificate_expiry_zuul]
• File[/etc/cfssl/signers/aux/cfssl.conf]
• File[/lib/systemd/system/nrpe2nodexp-ferm_active.service]
• File[/etc/apache2/conf-available/50-server-status.conf]
• Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)]
• Cfssl::Signer[discovery2026]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cassandra.prom]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_kafka]
• Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
• File[/etc/cfssl/signers/mlserve/ca/mlserve.pem]
• Rsyslog::Conf[cfssl-ocsprefresh-zuul]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service]
• Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging]
• Systemd::Service[cfssl-ocsprefresh-mlserve_front_proxy]
• Service[cfssl-ocspserve@mlserve_staging]
• Service[cfssl-multirootca]
• Nrpe::Check[check_check_certificate_expiry_dse]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
• File[/etc/cfssl/signers/puppet_rsa]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]
• Logrotate::Conf[cfssl-ocsprefresh-discovery]
• Systemd::Syslog[cfssl-ocsprefresh-discovery2026]
• Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet refresh]
• Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
• Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_network_devices]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]
• File[/lib/systemd/system/cfssl-gc-expired-certs.service]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]
• File[/var/log/cfssl-ocsprefresh-zuul]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
• Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy]
• File[/etc/cfssl/ocsp/cloud_wmnet_ca.ocsp]
• File[/etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)]
• Nrpe::Monitor_service[check_certificate_expiry_mlserve]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cloud_wmnet_ca]
• File[/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]
• File_line[load_env_enabled]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube]
• Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-status-restart)]
• Systemd::Timer[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
• Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
• Systemd::Timer[cfssl-ocsprefresh-etcd]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf]
• File[/lib/systemd/system/cfssl-multirootca.service]
• Service[cfssl-ocspserve@syslog]
• Systemd::Timer[cfssl-ocsprefresh-zuul]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
• Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.timer]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)]
• Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet refresh]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)]
• File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]
• Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)]
• Sudo::User[nrpe-check_check_certificate_expiry_cloud_wmnet_ca]
• Systemd::Service[cfssl-ocspserve@wikikube_staging]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service]
• Service[cfssl-ocsprefresh-zuul.timer]
• File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
• Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]
• Systemd::Syslog[cfssl-ocsprefresh-cloud_wmnet_ca]
• File[/srv/cfssl/bundles/mlserve.pem]
• Cfssl::Cert[OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
• File[/etc/systemd/system/ferm.service.d]
• Cfssl::Signer[mlserve_staging_front_proxy]
• Sudo::User[nrpe_certificate_check_dse_front_proxy]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
• Prometheus::Blackbox::Check::Http[PKI_debmonitor]
• Cfssl::Signer[wikikube_staging]
• Sudo::User[nrpe_certificate_check_discovery]
• Cfssl::Signer[wikikube_staging_front_proxy]
• File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
• Ferm::Service[multirootca_tls_termination]
• File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
• File[/etc/cfssl/signers/syslog]
• File[/etc/apache2/conf-available/00-defaults.conf]
• Prometheus::Node_textfile[prometheus-check-zuul-certificate-expiry]
• Rsyslog::Conf[nrpe2nodexp-check_cfssl-multirootca_status]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
• File[/etc/cfssl/signers/aux_front_proxy]
• Sudo::User[nrpe_certificate_check_network_devices]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve]
• Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]
• File[/etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods]
• Systemd::Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
• Prometheus::Alert::Rule[check_ferm_active_bba0a2572329bb500b832470e08b381c]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)]
• File[/etc/cfssl/signers/discovery2026/cfssl.conf]
• Systemd::Timer::Job[cfssl-ocsprefresh-wikikube]
• Exec[renew certificate - OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
• Sudo::User[nrpe_certificate_check_mlserve]
• File[/lib/systemd/system/wmf_auto_restart_apache2.service]
• File[/etc/cfssl/signers/syslog/ca/syslog-key.pem]
• Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)]
• Systemd::Unit[cfssl-ocsprefresh-debmonitor.timer]
• File[/etc/apache2/conf-enabled/50-server-status.conf]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf]
• Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.timer]
• Cfssl::Signer[mlserve]
• Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)]
• Service[ulogd2]
• Monitoring::Service[check_certificate_expiry_wikikube_staging]
• Prometheus::Alert::Rule[check_check_certificate_expiry_zuul_373325faaa689f3e9b058d91d4eb6cdb]
• Prometheus::Node_textfile[prometheus-check-cloud_wmnet_ca-certificate-expiry]
• Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf]
• File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
• Ferm::Service[full_monitoring_metrics_access_udp]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
• Service[cfssl-ocspserve@network_devices]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
• Sudo::User[nrpe-check_check_certificate_expiry_puppet_rsa]
• File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging]
• Ferm::Service[ssh_from_bastion]
• Service[cfssl-ocspserve@discovery2026]
• Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]
• Systemd::Timer::Job[cfssl-ocsprefresh-cassandra]
• File[/lib/systemd/system/wmf_auto_restart_apache2.timer]
• File[/etc/cfssl/signers/discovery2026]
• File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.timer]
• Service[cfssl-ocspserve@wikikube_staging]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
• File[/etc/ferm/conf.d]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
• Systemd::Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
• File[/etc/cfssl/signers/zuul/ca/zuul-key.pem]
• Cfssl::Ocsp[wikikube_front_proxy]
• Service[cfssl-ocsprefresh-wikikube_staging.timer]
• Systemd::Service[cfssl-ocspserve@cloud_wmnet_ca]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)]
• Systemd::Service[cfssl-ocsprefresh-discovery2026]
• Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet refresh]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_kafka]
• Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)]
• File[/usr/local/bin/apache-status]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
• File[/var/log/cfssl-ocsprefresh-puppet_rsa]
• Service[cfssl-ocspserve@kafka]
• Exec[Generate initial CRL for mlserve]
• File[/etc/ferm/conf.d/10_csr_and_ocsp_responder]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
• Systemd::Unit[wmf_auto_restart_ulogd2.service]
• Systemd::Unit[cfssl-ocsprefresh-discovery2026.service]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
• File[/var/log/cfssl-ocsprefresh-wikikube]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf]
• Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet refresh]
• Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging_front_proxy.prom]
• Prometheus::Node_textfile[prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf]
• Cfssl::Config[mlserve]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
• Exec[apache2_test_config_and_restart]
• Cfssl::Cert[OCSP_dse_pki1001_eqiad_wmnet]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf]
• Nrpe::Check[check_ferm_active]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg]
• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging_front_proxy]
• Cfssl::Cert[OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_zuul]
• Cfssl::Config[wikikube_front_proxy]
• File[/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry]
• File[/etc/apache2/conf-enabled/50-cfssl-issuer-k8s-pods-vhost-port.conf]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.timer]
• Systemd::Timer::Job[cfssl-ocsprefresh-syslog]
• Prometheus::Blackbox::Check::Http[PKI_wikikube_staging]
• Exec[Generate initial CRL for network_devices]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]
• Systemd::Unit[cfssl-ocspserve@puppet_rsa]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg]
• Service[cfssl-ocspserve@dse_front_proxy]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)]
• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
• Prometheus::Blackbox::Check::Http[PKI_discovery2026]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer]
• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
• File[/lib/systemd/system/cfssl-ocspserve@discovery2026.service]
• File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf]
• Cfssl::Cert[puppet_rsa__pki_discovery_wmnet]
• Cfssl::Cert[OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
• File[/usr/local/bin/prometheus-check-debmonitor-certificate-expiry]
• Exec[renew certificate - OCSP_discovery_pki1001_eqiad_wmnet]
• File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem]
• Systemd::Unit[cfssl-ocspserve@discovery2026]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)]
• File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]
• Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
• Prometheus::Alert::Rule[check_check_certificate_expiry_dse_front_proxy_2560f4f577ba169af651cf96bd5dc1ba]
• File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
• Prometheus::Alert::Rule[check_check_certificate_expiry_aux_front_proxy_99cf4f8f014e8fd527800abcc213f494]
• Cfssl::Config[etcd]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery]
• File[/etc/cfssl/signers/discovery]
• Logrotate::Conf[cfssl-ocsprefresh-mlserve]
• Exec[Generate initial CRL for debmonitor]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]
• Cfssl::Cert[OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
• Service[cfssl-ocsprefresh-dse.timer]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
• Systemd::Service[cfssl-ocspserve@zuul]
• Service[nrpe2nodexp-check_certificate_expiry_discovery.timer]
• Systemd::Service[cfssl-ocspserve@mlserve]
• Systemd::Service[cfssl-ocspserve@wikikube_front_proxy]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
• Motd::Script[pki::multirootca]
• Service[cfssl-ocsprefresh-aux_front_proxy.timer]
• Cfssl::Ocsp[discovery]
• Systemd::Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
• File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
• File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]
• File[/etc/cfssl/signers/mlserve/ca]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
• Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_front_proxy_b194b5b9b6c9d6e05b9eed8dcfcc40cf]
• Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]
• File[/lib/systemd/system/cfssl-ocsprefresh-aux.timer]
• Systemd::Unit[cfssl-ocsprefresh-wikikube.service]
• Prometheus::Node_textfile[prometheus-check-wikikube_staging-certificate-expiry]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
• Systemd::Timer[cfssl-ocsprefresh-wikikube]
• File[/etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
• Package[python3-pymysql]
• File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_syslog]
• Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet refresh]
• Systemd::Timer[cfssl-ocsprefresh-network_devices]
• Ferm::Conf[defs]
• Cfssl::Config[puppet_rsa]
• Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_front_proxy_4d759acaf0fd7dd3abaa03dc4565aef6]
• File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet]
• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service]
• File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service]
• Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)]
• Class[Httpd]
• Httpd::Conf[server-status]
• Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa]
• File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube]
• Cfssl::Ocsp[mlserve_front_proxy]
• Nrpe::Monitor_service[check_certificate_expiry_syslog]
• File[/etc/apache2/conf-enabled/00-defaults.conf]
• Systemd::Service[cfssl-ocsprefresh-wikikube_staging]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf]
• Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]
• Systemd::Syslog[cfssl-ocsprefresh-discovery]
• File[/etc/sudoers.d/nrpe_certificate_check_network_devices]
• Motd::Message[pki::multirootca]
• Exec[update_alternative_ip6tables]
• Cfssl::Signer[wikikube_front_proxy]
• Cfssl::Ocsp[wikikube]
• File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery2026]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery]
• File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
• Alternatives::Select[iptables]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]
• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
• File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
• Exec[update_alternative_iptables]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
• File[/lib/systemd/system/cfssl-ocsprefresh-dse.service]
• File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem]
• Service[nrpe2nodexp-check_certificate_expiry_aux.timer]
• Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service]
• Ferm::Rule[log-everything]
• Profile::Pki::Multirootca::Monitoring[mlserve_front_proxy]
• Rsyslog::Conf[cfssl-ocsprefresh-kafka]
• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.timer]
• Service[cfssl-ocsprefresh-debmonitor.timer]
• File[/etc/default/ferm]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)]
• File[/etc/cfssl/signers/dse/ca/dse.pem]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
• Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet refresh]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve]
• File[/srv/cfssl/bundles/wikikube.pem]
• Rsyslog::Conf[wmf_auto_restart_ulogd2]
• Service[cfssl-gc-expired-certs.timer]
• File[/etc/ferm/conf.d/10_ssh_from_cumin_masters]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf]
• Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging]
• Systemd::Timer[cfssl-ocsprefresh-puppet_rsa]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf]
• Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]
• Profile::Auto_restarts::Service[apache-htcacheclean]
• File[/etc/cfssl/ocsp/syslog.ocsp]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf]
• File[/etc/logrotate.d/wmf_auto_restart_apache2]
• Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_bfd2f7c6497e1da6323bef48d24f9e8e]
• File[/lib/systemd/system/cfssl-ocsprefresh-dse.timer]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]
• Nrpe::Check[check_check_certificate_expiry_wikikube_staging_front_proxy]
• Service[cfssl-ocspserve@wikikube_staging_front_proxy]
• File[/etc/ferm/conf.d/98_filter_log_filter-bootp]
• Sudo::User[nrpe-check_check_certificate_expiry_wikikube]
• Rsyslog::Conf[cfssl-ocsprefresh-wikikube_front_proxy]
• Profile::Pki::Multirootca::Monitoring[mlserve_staging]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)]
• Cfssl::Config[cloud_wmnet_ca]
• File[/etc/cfssl/signers/syslog/ca/syslog.pem]
• File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]
• File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]
• Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
• Cfssl::Ocsp[mlserve_staging_front_proxy]
• Logrotate::Conf[wmf_auto_restart_ulogd2]
• Profile::Pki::Multirootca::Monitoring[kafka]
• File[/etc/ferm/conf.d/99_dscp-default]
• Profile::Pki::Multirootca::Monitoring[discovery2026]
• Prometheus::Blackbox::Check::Http[PKI_dse]
• Systemd::Service[cfssl-ocspserve@network_devices]
• Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]
• Httpd::Mod_conf[proxy_http]
• Exec[ensure_present_mod_headers]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]
• Ferm::Service[multirootca_tls_termination_for_cfssl_issuer_k8s_pods]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)]
• Rsyslog::Conf[cfssl-ocsprefresh-etcd]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_etcd]
• Cfssl::Ocsp[debmonitor]
• Systemd::Unit[cfssl-ocspserve@aux]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]
• File[/etc/cfssl/signers/cassandra/cfssl.conf]
• File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
• Systemd::Timer[cfssl-ocsprefresh-wikikube_staging]
• Systemd::Service[cfssl-ocsprefresh-cassandra]
• File[/srv/cfssl/bundles/network_devices.pem]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]
• File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem]
• Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
• Systemd::Unit[cfssl-ocspserve@dse]
• File[/srv/cfssl/bundles/dse.pem]
• File[/var/log/cfssl-ocsprefresh-network_devices]
• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
• Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]
• File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]
• File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem]
• Systemd::Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
• Nrpe::Monitor_service[check_certificate_expiry_debmonitor]
• Prometheus::Node_textfile[prometheus-check-mlserve-certificate-expiry]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]
• Systemd::Unit[cfssl-ocspserve@wikikube_staging_front_proxy]
• File[/lib/systemd/system/cfssl-ocspserve@syslog.service]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_etcd]
• Systemd::Unit[cfssl-ocspserve@dse_front_proxy]
• Logrotate::Conf[cfssl-ocsprefresh-dse_front_proxy]
• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service]
• Cfssl::Signer[debmonitor]
• Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
• File[/lib/systemd/system/cfssl-ocspserve@dse.service]
• Exec[Generate initial CRL for mlserve_front_proxy]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)]
• Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]
• Service[cfssl-ocsprefresh-mlserve.timer]
• Nrpe::Monitor_service[check_certificate_expiry_aux_front_proxy]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
• Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)]
• File[/lib/systemd/system/wmf_auto_restart_ulogd2.timer]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]
• Service[cfssl-ocspserve@etcd]
• Systemd::Unit[cfssl-ocsprefresh-kafka.service]
• Profile::Pki::Multirootca::Monitoring[aux_front_proxy]
• Monitoring::Service[check_certificate_expiry_discovery]
• Sudo::User[nrpe-check_check_certificate_expiry_aux_front_proxy]
• Systemd::Unit[cfssl-ocsprefresh-cassandra.timer]
• Profile::Pki::Multirootca::Monitoring[debmonitor]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]
• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]
• File[/var/log/cfssl-ocsprefresh-kafka]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_kafka]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]
• Rsyslog::Conf[cfssl-ocsprefresh-puppet_rsa]
• File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer]
• File[/etc/cfssl/signers/etcd/ca/etcd.pem]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging]
• File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer]
• Logrotate::Conf[cfssl-ocsprefresh-cassandra]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
• Systemd::Service[cfssl-ocspserve@aux]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
• File[/lib/systemd/system/cfssl-ocspserve@discovery.service]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
• Logrotate::Conf[cfssl-ocsprefresh-wikikube_front_proxy]
• Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)]
• Cfssl::Config[network_devices]
• Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
• Systemd::Timer::Job[cfssl-ocsprefresh-discovery]
• Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
• File[/etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf]
• Cfssl::Ocsp[cloud_wmnet_ca]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)]
• Logrotate::Conf[cfssl-ocsprefresh-mlserve_front_proxy]
• File[/etc/logrotate.d/cfssl-ocsprefresh-discovery]
• Nrpe::Check[check_check_certificate_expiry_mlserve_staging_front_proxy]
• Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging]
• Cfssl::Ocsp[wikikube_staging_front_proxy]
• Monitoring::Service[check_certificate_expiry_etcd]
• Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
• File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem]
• Sudo::User[nrpe_certificate_check_kafka]
• Httpd::Conf[cfssl-issuer-k8s-pods-vhost-port]
• Systemd::Syslog[cfssl-ocsprefresh-aux]
• File[/etc/cfssl/db.conf]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_cassandra]
• File[/etc/cfssl/signers/mlserve_staging]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
• File[/srv/cfssl/bundles/debmonitor.pem]
• File[/etc/sudoers.d/nrpe_certificate_check_aux]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
• Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve]
• File[/srv/cfssl/bundles/discovery2026.pem]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_zuul.prom]
• Systemd::Syslog[cfssl-ocsprefresh-puppet_rsa]
• File[/etc/cfssl/ocsp/network_devices.ocsp]
• Nrpe::Monitor_service[check_certificate_expiry_kafka]
• Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet]
• File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf]
• File[/etc/logrotate.d/cfssl-ocsprefresh-kafka]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
• Rsyslog::Conf[cfssl-ocsprefresh-dse]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf]
• Firewall::Service[multirootca tls termination]
• File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.service]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]
• File[/etc/cfssl/signers/cloud_wmnet_ca/ca]
• Monitoring::Service[check_certificate_expiry_dse]
• File[/etc/apache2/sites-available/00-dummy.conf]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]
• Systemd::Timer[cfssl-ocsprefresh-dse]
• Nrpe::Check[check_check_certificate_expiry_mlserve_front_proxy]
• Systemd::Unit[cfssl-ocspserve@kafka]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]
• Systemd::Syslog[cfssl-ocsprefresh-wikikube]
• Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)]
• Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)]
• File_line[auto_restart_file_presence_apache2]
• Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)]
• Exec[renew certificate - OCSP_network_devices_pki1001_eqiad_wmnet]
• Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service]
• File[/etc/cfssl/signers/mlserve_staging/cfssl.conf]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]
• Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet]
• Systemd::Timer::Job[cfssl-ocsprefresh-mlserve]
• Class[Cfssl::Multirootca]
• File[/etc/sudoers.d/nrpe_certificate_check_mlserve_front_proxy]
• Systemd::Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
• Systemd::Service[cfssl-ocspserve@debmonitor]
• File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
• Service[apache2]
• Systemd::Service[cfssl-ocsprefresh-discovery]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
• File[/etc/cfssl/signers/kafka]
• Logrotate::Conf[cfssl-ocsprefresh-debmonitor]
• Prometheus::Blackbox::Check::Http[PKI_mlserve]
• Cfssl::Signer[dse]
• File[/etc/logrotate.d/ulogd]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)]
• Cfssl::Signer[aux_front_proxy]
• File[/srv/cfssl/crl]
• Prometheus::Blackbox::Check::Http[PKI_dse_front_proxy]
• Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet]
• File[/etc/ferm/conf.d/02_main]
• Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_f389c556cebfcfc345b3d6802f320045]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)]
• File[/etc/logrotate.d/cfssl-ocsprefresh-network_devices]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)]
• File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_debmonitor]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
• Cfssl::Cert[OCSP_kafka_pki1001_eqiad_wmnet]
• Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging_front_proxy]
• File[/etc/cfssl/signers/mlserve_staging/ca]
• Nrpe::Monitor_service[check_certificate_expiry_mlserve_front_proxy]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)]
• Systemd::Service[cfssl-ocsprefresh-dse_front_proxy]
• Monitoring::Service[check_certificate_expiry_mlserve_staging]
• Systemd::Service[cfssl-gc-expired-certs]
• File[/srv/cfssl/bundles/wikikube_staging.pem]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg]
• File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service]
• Exec[Generate initial CRL for discovery2026]
• Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)]
• File[/lib/systemd/system/cfssl-ocsprefresh-aux.service]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]
• Monitoring::Service[check_certificate_expiry_wikikube_front_proxy]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf]
• Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet]
• File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca]
• Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging_front_proxy]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
• File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging.service]
• File[/etc/cfssl/ocsp/debmonitor.ocsp]
• Profile::Pki::Multirootca::Monitoring[mlserve_staging_front_proxy]
• Systemd::Syslog[cfssl-ocsprefresh-aux_front_proxy]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]
• Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy]
• Sudo::User[nrpe_certificate_check_mlserve_front_proxy]
• Exec[renew certificate - puppet_rsa__pki_discovery_wmnet]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service]
• File[/var/log/cfssl-ocsprefresh-mlserve]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)]
• Systemd::Timer[cfssl-gc-expired-certs]
• File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer]
• Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet]
• File[/etc/ferm/conf.d/00_defs]
• Nrpe::Monitor_service[check_certificate_expiry_wikikube]
• Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change]
• Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
• File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
• Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_d2a76a31e44e204e2d4788a2698d0e6c]
• File[/etc/cfssl/signers/discovery/cfssl.conf]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
• Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf]
• File[/etc/apache2/sites-enabled]
• Profile::Pki::Multirootca::Monitoring[syslog]
• Service[nrpe2nodexp-ferm_active.timer]
• Nrpe::Check[check_check_certificate_expiry_zuul]
• Systemd::Unit[cfssl-ocspserve@discovery]
• Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)]
• Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.timer]
• Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]
• Cfssl::Config[wikikube_staging]
• Sudo::User[nrpe_certificate_check_aux_front_proxy]
• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.service]
• Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service]
• Prometheus::Node_textfile[prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
• Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog]
• Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet]
• Service[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cassandra]
• Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]
• File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux]
• Nrpe::Monitor_service[check_certificate_expiry_cassandra]
• Systemd::Service[cfssl-ocspserve@discovery2026]
• Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra]
• Profile::Pki::Multirootca::Monitoring[dse_front_proxy]
• Service[wmf_auto_restart_apache2.timer]
• Service[apache-htcacheclean]
• File[/lib/systemd/system/cfssl-ocspserve@zuul.service]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)]
• Systemd::Timer::Job[cfssl-gc-expired-certs]
• File[/etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
• File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem]
• File[/etc/apache2/conf-available]
• File[/etc/cfssl/signers/network_devices/cfssl.conf]
• Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)]
• File[/etc/sudoers.d/nrpe_certificate_check_mlserve]
• Nrpe::Monitor_service[check_certificate_expiry_puppet_rsa]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]
• Systemd::Service[cfssl-ocspserve@aux_front_proxy]
• Logrotate::Conf[cfssl-ocsprefresh-aux]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf]
• File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]
• Systemd::Unit[cfssl-ocsprefresh-dse.timer]
• Logrotate::Conf[cfssl-ocsprefresh-aux_front_proxy]
• File[/usr/local/bin/prometheus-check-zuul-certificate-expiry]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]
• File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging_front_proxy.prom]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_network_devices]
• File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem]
• Prometheus::Node_textfile[prometheus-check-aux-certificate-expiry]
• File[/etc/logrotate.d/wmf_auto_restart_ulogd2]
• File[/usr/local/bin/prometheus-check-etcd-certificate-expiry]
• Logrotate::Conf[wmf_auto_restart_apache2]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cassandra]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
• Sudo::User[nrpe_certificate_check_cassandra]
• Profile::Pki::Multirootca::Monitoring[wikikube_staging_front_proxy]
• File[/etc/cfssl/signers/zuul]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]
• Sudo::User[nrpe-check_check_certificate_expiry_discovery]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
• Service[nrpe2nodexp-check_certificate_expiry_etcd.timer]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
• Rsyslog::Conf[cfssl-ocsprefresh-debmonitor]
• File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)]
• Profile::Pki::Multirootca::Monitoring[wikikube_front_proxy]
• Prometheus::Node_textfile[prometheus-check-etcd-certificate-expiry]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
• File[/etc/cfssl/signers/wikikube_staging/cfssl.conf]
• Rsyslog::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]
• File[/etc/nagios/nrpe.d/check_ferm_active.cfg]
• Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging]
• File[/etc/logrotate.d/cfssl-ocsprefresh-discovery2026]
• File[/etc/cfssl/signers/wikikube_staging_front_proxy]
• Systemd::Service[cfssl-ocsprefresh-etcd]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]
• Exec[Generate initial CRL for puppet_rsa]
• File[/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
• Cfssl::Ocsp[mlserve]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf]
• Rsyslog::Conf[wmf_auto_restart_apache2]
• File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem]
• Rsyslog::Conf[cfssl-ocsprefresh-mlserve_front_proxy]
• File[/etc/cfssl/signers/wikikube_front_proxy]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
• Service[cfssl-ocsprefresh-discovery2026.timer]
• Service[nrpe2nodexp-check_certificate_expiry_cassandra.timer]
• Profile::Pki::Multirootca::Monitoring[etcd]
• File[/var/log/cfssl-ocsprefresh-discovery]
• Cfssl::Cert[OCSP_syslog_pki1001_eqiad_wmnet]
• File[/etc/sudoers.d/nrpe_certificate_check_kafka]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)]
• Systemd::Unit[cfssl-ocsprefresh-wikikube.timer]
• File[/etc/cfssl/signers/network_devices]
• Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf]
• Nrpe::Check[check_check_certificate_expiry_puppet_rsa]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]
• Prometheus::Blackbox::Check::Http[PKI_mlserve_staging_front_proxy]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.timer]
• File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem]
• Service[cfssl-ocsprefresh-network_devices.timer]
• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service]
• File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging]
• Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet refresh]
• File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
• File[/var/log/cfssl-ocsprefresh-syslog]
• Nrpe::Monitor_service[check_certificate_expiry_dse_front_proxy]
• Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)]
• File[/etc/apache2/env-enabled]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)]
• Systemd::Timer::Job[cfssl-ocsprefresh-aux]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]
• File[/srv/cfssl/bundles/puppet_rsa.pem]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve]
• Systemd::Unit[cfssl-ocsprefresh-mlserve.timer]
• Systemd::Timer[cfssl-ocsprefresh-mlserve_staging_front_proxy]
• File[/etc/cfssl/signers/mlserve_front_proxy]
• File[/etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp]
• File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
• Cfssl::Signer[mlserve_front_proxy]
• File[/etc/cfssl/signers/dse/cfssl.conf]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
• Httpd::Site[dummy]
• File_line[auto_restart_file_presence_ulogd2]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]
• Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]
• Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery2026]
• Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy]
• Cfssl::Signer[syslog]
• File[/etc/cfssl/ocsp/mlserve.ocsp]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
• Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet refresh]
• Monitoring::Service[check_certificate_expiry_dse_front_proxy]
• Profile::Pki::Multirootca::Monitoring[cassandra]
• File[/etc/ferm/conf.d/10_ssh_from_bastion]
• Systemd::Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
• Systemd::Unit[wmf_auto_restart_apache2.service]
• File[/etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg]
• File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy]
• Systemd::Syslog[cfssl-ocsprefresh-wikikube_front_proxy]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf]
• File[/etc/cfssl/signers/dse_front_proxy/cfssl.conf]
• File[/etc/cfssl/signers/mlserve/ca/mlserve-key.pem]
• File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem]
• Nrpe::Monitor_service[check_cfssl-multirootca_status]
• Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
• File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
• File[/etc/cfssl/signers/network_devices/ca/network_devices.pem]
• File[/var/log/cfssl-ocsprefresh-aux]
• File[/var/log/cfssl-ocsprefresh-debmonitor]
• Prometheus::Blackbox::Check::Http[PKI_cloud_wmnet_ca]
• File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
• Httpd::Conf[defaults]
• Service[cfssl-ocspserve@debmonitor]
• Systemd::Unit[cfssl-ocsprefresh-aux.service]
• File[/etc/systemd/system/ferm.service.d/ferm-service-status-restart.conf]
• Service[cfssl-ocsprefresh-syslog.timer]
• Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy]
• File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
• Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
• Exec[Generate initial CRL for kafka]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
• File[/etc/cfssl/signers/mlserve]
• File[/srv/cfssl]
• Prometheus::Node_textfile[prometheus-check-mlserve_front_proxy-certificate-expiry]
• Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet]
• File[/lib/systemd/system/cfssl-ocspserve@etcd.service]
• Systemd::Timer::Job[wmf_auto_restart_ulogd2]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_etcd]
• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service]
• File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_zuul]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf]
• Logrotate::Conf[cfssl-gc-expired-certs]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
• Systemd::Timer[cfssl-ocsprefresh-wikikube_staging_front_proxy]
• Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_network_devices]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]
• File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging_front_proxy]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa]
• Prometheus::Blackbox::Check::Http[PKI_syslog]
• Exec[Generate initial CRL for wikikube_staging]
• Systemd::Unit[cfssl-ocsprefresh-discovery.timer]
• Sudo::User[nrpe_certificate_check_wikikube_front_proxy]
• Rsyslog::Conf[wmf_auto_restart_apache-htcacheclean]
• Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service]
• Systemd::Unit[wmf_auto_restart_apache-htcacheclean.timer]
• File[/etc/sudoers.d/nrpe_certificate_check_wikikube_front_proxy]
• Exec[renew certificate - OCSP_aux_pki1001_eqiad_wmnet]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
• File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
• Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet refresh]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux.prom]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]
• Cfssl::Config[dse_front_proxy]
• File[/usr/local/bin/prometheus-check-kafka-certificate-expiry]
• File[/etc/ulogd.conf]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_syslog]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]
• File[/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]
• Prometheus::Alert::Rule[check_check_certificate_expiry_discovery2026_bf2e3510cb63e5f05f545e816bab4edf]
• Systemd::Service[cfssl-ocsprefresh-aux_front_proxy]
• File[/lib/systemd/system/nrpe2nodexp-ferm_active.timer]
• File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
• File[/etc/cfssl/signers/puppet_rsa/cfssl.conf]
• Systemd::Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
• Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_kafka.prom]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube.prom]
• Cfssl::Config[zuul]
• File[/etc/cfssl/multiroot.conf]
• File[/lib/systemd/system/cfssl-ocspserve@mlserve.service]
• Class[Sslcert::Dhparam]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
• Systemd::Service[cfssl-ocspserve@discovery]
• Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
• Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]
• File[/etc/cfssl/ocsp/puppet_rsa.ocsp]
• File[/var/log/cfssl-gc-expired-certs]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_debmonitor.prom]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)]
• Service[cfssl-ocsprefresh-etcd.timer]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]
• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem]
• Logrotate::Conf[cfssl-ocsprefresh-syslog]
• Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]
• Nrpe::Check[check_check_certificate_expiry_wikikube_front_proxy]
• Prometheus::Blackbox::Check::Http[PKI_zuul]
• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
• Exec[renew certificate - OCSP_mlserve_staging_pki1001_eqiad_wmnet]
• Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)]
• File[/srv/cfssl/bundles/mlserve_front_proxy.pem]
• File[/etc/cfssl/signers/discovery/ca]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]
• File[/etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf]
• Systemd::Timer::Job[nrpe2nodexp-check_cfssl-multirootca_status]
• File[/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf]
• File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]
• File[/etc/cfssl/signers/aux]
• Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet]
• File[/etc/cfssl/signers/dse/ca]
• File[/etc/cfssl/signers/dse_front_proxy]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse]
• File[/etc/cfssl/signers/discovery/ca/discovery-key.pem]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]
• File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service]
• File[/etc/sudoers.d/nrpe-check_check_cfssl-multirootca_status]
• File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)]
• Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.timer]
• Profile::Pki::Multirootca::Monitoring[network_devices]
• Ferm::Filter_log[filter-bootp]
• Httpd::Mod_conf[ssl]
• Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]
• Nrpe::Check[check_check_certificate_expiry_etcd]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.timer]
• Prometheus::Node_textfile[prometheus-check-discovery2026-certificate-expiry]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
• File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.service]
• Httpd::Mod_conf[filter]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]
• File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem]
• Cfssl::Signer[wikikube]
• Exec[Generate initial CRL for wikikube_staging_front_proxy]
• File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem]
• File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]
• File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]
• Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)]
• Httpd::Conf[dummy]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
• File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem]
• Sudo::User[nrpe_certificate_check_puppet_rsa]
• File[/etc/apache2/sites-enabled/50-pki-discovery-wmnet.conf]
• File[/etc/cfssl/signers/etcd/cfssl.conf]
• Profile::Pki::Multirootca::Monitoring[dse]
• Cfssl::Config[discovery]
• File[/etc/cfssl/signers/aux/ca/aux.pem]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]
• Systemd::Service[cfssl-ocspserve@dse_front_proxy]
• Systemd::Syslog[cfssl-ocsprefresh-cassandra]
• File[/etc/sudoers.d/nrpe_certificate_check_zuul]
• File[/srv/cfssl/bundles/wikikube_front_proxy.pem]
• Systemd::Timer[cfssl-ocsprefresh-mlserve_front_proxy]
• Exec[Generate initial CRL for etcd]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]
• File[/etc/cfssl/ocsp/dse.ocsp]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
• Prometheus::Blackbox::Check::Http[PKI_aux]
• Systemd::Timer::Job[wmf_auto_restart_apache2]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
• File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
• Cfssl::Config[syslog]
• File[/etc/cfssl/signers/dse_front_proxy/ca]
• Ferm::Service[ssh_from_cumin_masters]
• Exec[ensure_present_mod_status]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]
• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]
• Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)]
• Exec[renew certificate - OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)]
• File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
• File[/usr/local/bin/prometheus-check-wikikube-certificate-expiry]
• Exec[Generate initial CRL for dse]
• Exec[renew certificate - OCSP_wikikube_staging_pki1001_eqiad_wmnet]
• File[/etc/cfssl/signers/cassandra/ca/cassandra.pem]
• Systemd::Syslog[cfssl-ocsprefresh-network_devices]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
• File[/lib/systemd/system/cfssl-ocspserve@puppet_rsa.service]
• Exec[renew certificate - OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
• File[/etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf]
• Cfssl::Cert[OCSP_aux_pki1001_eqiad_wmnet]
• File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
• Prometheus::Alert::Rule[check_check_certificate_expiry_cloud_wmnet_ca_f87f54115f2f782169eed72541c30a1e]
• Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]
• Service[nrpe2nodexp-check_certificate_expiry_zuul.timer]
• Systemd::Monitor[cfssl-multirootca]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_network_devices]
• File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy]
• Sudo::User[nrpe-check_check_certificate_expiry_wikikube_front_proxy]
• Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]
• Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_debmonitor]
• Nrpe::Check[check_check_certificate_expiry_wikikube_staging]
• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.service]
• Prometheus::Blackbox::Check::Http[PKI_etcd]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]
• Exec[Generate initial CRL for cassandra]
• Systemd::Unit[cfssl-ocsprefresh-discovery2026.timer]
• Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet refresh]
• Monitoring::Exported_nagios_service[pki1001 check_cfssl-multirootca_status]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd]
• File[/var/log/cfssl-ocsprefresh-dse]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]
• Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet refresh]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)]
• File[/lib/systemd/system/wmf_auto_restart_ulogd2.service]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf]
• Cfssl::Ocsp[dse]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf]
• Cfssl::Config[aux]
• Systemd::Service[nrpe2nodexp-ferm_active]
• Logrotate::Conf[cfssl-ocsprefresh-puppet_rsa]
• File[/usr/local/sbin/cfssl-certs]
• File[/etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf]
• Systemd::Service[cfssl-ocsprefresh-wikikube]
• Sudo::User[nrpe_certificate_check_mlserve_staging_front_proxy]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf]
• File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_etcd]
• Service[cfssl-ocspserve@mlserve_staging_front_proxy]
• File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)]
• File[/etc/sudoers.d/nrpe_certificate_check_cloud_wmnet_ca]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]
• Systemd::Unit[cfssl-ocsprefresh-dse.service]
• Cfssl::Ocsp[dse_front_proxy]
• File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem]
• Systemd::Service[cfssl-ocspserve@mlserve_front_proxy]
• File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)]
• File[/etc/cfssl/signers/zuul/cfssl.conf]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cloud_wmnet_ca.prom]
• File[/var/log/wmf_auto_restart_apache-htcacheclean]
• File[/srv/cfssl/bundles/aux_front_proxy.pem]
• Monitoring::Service[check_certificate_expiry_kafka]
• File[/srv/cfssl/bundles/mlserve_staging.pem]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
• File[/etc/apache2/sites-available/50-pki-discovery-wmnet.conf]
• File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem]
• Alternatives::Select[ip6tables]
• Cfssl::Ocsp[wikikube_staging]
• File[/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_syslog]
• Prometheus::Node_textfile[prometheus-check-mlserve_staging-certificate-expiry]
• Prometheus::Blackbox::Check::Http[PKI_kafka]
• Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]
• File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]
• File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem]
• Cfssl::Signer[kafka]
• File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
• Exec[renew certificate - OCSP_etcd_pki1001_eqiad_wmnet]
• Monitoring::Service[check_certificate_expiry_wikikube]
• Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg]
• Systemd::Timer[nrpe2nodexp-check_cfssl-multirootca_status]
• File[/var/log/cfssl-ocsprefresh-cassandra]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
• Cfssl::Config[discovery2026]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]
• File[/etc/cfssl/signers/discovery/ca/discovery.pem]
• File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
• Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service]
• File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
• File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]
• File[/etc/cfssl/signers/kafka/ca/kafka.pem]
• File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_zuul]
• File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.timer]
• Systemd::Unit[cfssl-ocsprefresh-network_devices.timer]
• Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]
• Httpd::Conf[pki.discovery.wmnet]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.timer]
• Firewall::Service[multirootca-tls-termination-for-cfssl-issuer-k8s-pods]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse_front_proxy]
• Systemd::Unit[cfssl-ocspserve@mlserve_staging]
• Exec[renew certificate - OCSP_kafka_pki1001_eqiad_wmnet]
• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem]
• File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
• Logrotate::Conf[cfssl-ocsprefresh-dse]
• File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]
• File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem]
• File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
• Profile::Auto_restarts::Service[ulogd2]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
• File[/etc/ferm/conf.d/98_log-everything]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
• Systemd::Syslog[cfssl-ocsprefresh-kafka]
• Prometheus::Node_textfile[prometheus-check-wikikube-certificate-expiry]
• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]
• Service[nrpe2nodexp-check_certificate_expiry_dse.timer]
• File[/etc/sudoers.d/nrpe_certificate_check_discovery2026]
• File[/usr/local/bin/prometheus-check-cassandra-certificate-expiry]
• File[/etc/sudoers.d/nrpe-check_ferm_active]
• File[/etc/sudoers.d/nrpe_certificate_check_debmonitor]
• Systemd::Unit[nrpe2nodexp-ferm_active.service]
• Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
• Systemd::Service[cfssl-ocsprefresh-debmonitor]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_network_devices.prom]
• File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
• Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.service (nrpe2nodexp-ferm_active.service)]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)]
• File[/etc/cfssl/signers/wikikube/ca/wikikube-key.pem]
• File[/etc/cfssl/signers/syslog/ca]
• File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
• File[/srv/cfssl/bundles/wikikube_staging_front_proxy.pem]
• Systemd::Unit[cfssl-ocspserve@wikikube_staging]
• Systemd::Unit[cfssl-ocsprefresh-cassandra.service]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]
• Sudo::User[nrpe_certificate_check_discovery2026]
• File[/lib/systemd/system/cfssl-ocspserve@aux.service]
• File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]
• Nrpe::Monitor_service[check_certificate_expiry_network_devices]
• File[/etc/sudoers.d/nrpe_certificate_check_dse_front_proxy]
• Nrpe::Check[check_check_certificate_expiry_discovery2026]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg]
• File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]
• File[/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf]
• Prometheus::Node_textfile[prometheus-check-dse_front_proxy-certificate-expiry]
• Systemd::Unit[cfssl-ocspserve@debmonitor]
• Systemd::Unit[cfssl-ocsprefresh-zuul.service]
• Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
• Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]
• File[/etc/cfssl/ocsp/cassandra.ocsp]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
• Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf]
• Cfssl::Signer[discovery]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg]
• Systemd::Unit[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
• Systemd::Service[cfssl-ocsprefresh-dse]
• Systemd::Unit[cfssl-ocspserve@mlserve_staging_front_proxy]
• Service[cfssl-ocspserve@aux_front_proxy]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cassandra]
• Cfssl::Ocsp[cassandra]
• File[/var/log/cfssl-ocsprefresh-dse_front_proxy]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)]
• Prometheus::Blackbox::Check::Http[PKI_mlserve_staging]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]
• Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]
• File[/etc/cfssl/ocsp/aux_front_proxy.ocsp]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
• Systemd::Unit[cfssl-ocspserve@network_devices]
• Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]
• Node[__node_regexp__pki10012.eqiad.]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)]
• Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet refresh]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)]
• Monitoring::Service[check_certificate_expiry_syslog]
• Systemd::Override[ferm-service-status-restart]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)]
• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
• Systemd::Service[cfssl-ocspserve@puppet_rsa]
• Service[cfssl-ocsprefresh-kafka.timer]
• File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
• File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem]
• Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet refresh]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)]
• File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer]
• Sudo::User[nrpe-check_check_certificate_expiry_mlserve_front_proxy]
• Systemd::Timer[cfssl-ocsprefresh-wikikube_front_proxy]
• Systemd::Timer[cfssl-ocsprefresh-cloud_wmnet_ca]
• Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service]
• Prometheus::Blackbox::Check::Http[PKI_wikikube_front_proxy]
• Nrpe::Monitor_service[check_certificate_expiry_etcd]
• Cfssl::Ocsp[discovery2026]
• Service[cfssl-ocsprefresh-aux.timer]
• File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
• Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)]
• Systemd::Syslog[cfssl-ocsprefresh-etcd]
• Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet refresh]
• Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]
• Systemd::Timer::Job[wmf_auto_restart_apache-htcacheclean]
• Sudo::User[nrpe_certificate_check_wikikube_staging_front_proxy]
• Service[cfssl-ocspserve@wikikube]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
• File[/etc/cfssl/signers/kafka/ca]
• File[/var/log/cfssl-ocsprefresh-discovery2026]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
• Augeas[Apache2 logs]
• File[/etc/sudoers.d/nrpe_certificate_check_cassandra]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)]
• Monitoring::Service[check_certificate_expiry_mlserve]
• Class[Profile::Firewall::Log::Ferm]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
• File[/etc/ferm/conf.d/10_multirootca_tls_termination]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
• File[/srv/cfssl/bundles/zuul.pem]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_etcd]
• File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem]
• File[/etc/cfssl/ocsp/mlserve_front_proxy.ocsp]
• Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
• Exec[renew certificate - OCSP_puppet_rsa_pki1001_eqiad_wmnet]
• File[/etc/ferm/conf.d/01_drop-blocked-nets]
• Exec[renew certificate - OCSP_mlserve_pki1001_eqiad_wmnet]
• Httpd::Mod_conf[access_compat]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)]
• File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
• File[/etc/cfssl/signers/cassandra]
• File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer]
• Systemd::Timer[wmf_auto_restart_apache-htcacheclean]
• Cfssl::Ocsp[kafka]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]
• File[/etc/ssl/localcerts/multiroot_ca.pem]
• Prometheus::Blackbox::Check::Http[PKI_cassandra]
• Exec[renew certificate - OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
• Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
• File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
• Nrpe::Check[check_check_certificate_expiry_discovery]
• Systemd::Syslog[wmf_auto_restart_apache-htcacheclean]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
• File[/etc/logrotate.d/cfssl-ocsprefresh-syslog]
• File[/lib/systemd/system/cfssl-ocsprefresh-zuul.timer]
• Exec[renew certificate - OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
• Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
• Systemd::Service[cfssl-ocsprefresh-mlserve_staging]
• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg]
• File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
• Prometheus::Blackbox::Check::Http[PKI_wikikube]
• File[/etc/cfssl/ocsp/etcd.ocsp]
• File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem]
• Systemd::Unit[cfssl-ocsprefresh-etcd.service]
• Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]
• File[/etc/logrotate.d/cfssl-ocsprefresh-zuul]
• File[/usr/local/bin/prometheus-check-discovery2026-certificate-expiry]
• File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.service]
• File[/srv/cfssl/bundles/mlserve_staging_front_proxy.pem]
• File[/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf]
• Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]
• Systemd::Unit[cfssl-ocsprefresh-syslog.service]
• Cfssl::Config[wikikube_staging_front_proxy]
• Service[nrpe2nodexp-check_certificate_expiry_network_devices.timer]
• File[/etc/cfssl/signers/mlserve_front_proxy/ca]
• File[/etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp]
• File[/usr/local/bin/prometheus-check-dse-certificate-expiry]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
• Exec[renew certificate - OCSP_cassandra_pki1001_eqiad_wmnet]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux_front_proxy]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
• File[/etc/sudoers.d/nrpe_certificate_check_etcd]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)]
• Systemd::Syslog[cfssl-ocsprefresh-dse_front_proxy]
• Systemd::Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
• Service[cfssl-ocspserve@discovery]
• File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
• Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.timer (wmf_auto_restart_ulogd2.timer)]
• File[/etc/apache2/sites-enabled/00-dummy.conf]
• Httpd::Mod_conf[status]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]
• File[/etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca]
• Httpd::Mod_conf[headers]
• File[/etc/sudoers.d/nrpe_certificate_check_discovery]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]
• Exec[ensure_present_mod_access_compat]
• Nrpe::Check[check_check_certificate_expiry_syslog]
• Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]
• Cfssl::Signer[cassandra]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_puppet_rsa]
• File[/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry]
• File[/etc/logrotate.d/wmf_auto_restart_apache-htcacheclean]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf]
• Prometheus::Node_textfile[prometheus-check-cassandra-certificate-expiry]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]
• Systemd::Syslog[cfssl-ocsprefresh-syslog]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]
• Systemd::Service[cfssl-ocsprefresh-network_devices]
• File[/lib/systemd/system/cfssl-ocspserve@cassandra.service]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
• File[/srv/cfssl/bundles/kafka.pem]
• Sudo::User[nrpe_certificate_check_aux]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf]
• Rsyslog::Conf[cfssl-ocsprefresh-syslog]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery]
• File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]
• Prometheus::Alert::Rule[check_check_certificate_expiry_aux_f7dfe9e2cd77303dfae7ae11c5c56d90]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_zuul]
• Systemd::Unit[wmf_auto_restart_ulogd2.timer]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]
• Service[cfssl-ocspserve@dse]
• Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
• File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
• Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet refresh]
• File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr]
• File[/lib/systemd/system/cfssl-ocspserve@debmonitor.service]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
• File[/etc/apache2/env-available]
• Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet refresh]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
• File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service]
• File[/etc/cfssl/signers/aux_front_proxy/ca]
• Systemd::Timer[cfssl-ocsprefresh-kafka]
• File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
• File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]
• Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.service (wmf_auto_restart_ulogd2.service)]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)]
• Systemd::Unit[cfssl-ocspserve@mlserve_front_proxy]
• File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
• File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]
• File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
• Prometheus::Alert::Rule[check_check_certificate_expiry_dse_4384c5ebc49e03dbe331e279fac3f393]
• File[/etc/cfssl/signers/debmonitor/ca/debmonitor.pem]
• Rsyslog::Conf[cfssl-ocsprefresh-aux_front_proxy]
• Service[cfssl-ocsprefresh-wikikube.timer]
• Prometheus::Alert::Rule[check_check_cfssl-multirootca_status_52832284a5fb8b8ea6f55bb6271912c9]
• Logrotate::Conf[cfssl-ocsprefresh-wikikube]
• Service[cfssl-ocsprefresh-puppet_rsa.timer]
• File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem]
• Rsyslog::Conf[cfssl-ocsprefresh-dse_front_proxy]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_etcd.prom]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka]
• Systemd::Timer[nrpe2nodexp-ferm_active]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery2026.prom]
• Systemd::Unit[cfssl-ocsprefresh-discovery.service]
• Systemd::Service[cfssl-ocsprefresh-wikikube_front_proxy]
• Systemd::Timer[cfssl-ocsprefresh-discovery]
• Systemd::Unit[cfssl-ocspserve@aux_front_proxy]
• Systemd::Unit[ferm-ferm-service-status-restart]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
• Service[ferm]
• File[/var/log/cfssl-ocsprefresh-aux_front_proxy]
• Nrpe::Check[check_check_certificate_expiry_debmonitor]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
• File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem]
• File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem]
• Systemd::Syslog[cfssl-gc-expired-certs]
• Class[Profile::Pki::Multirootca]
• File[/var/log/cfssl-ocsprefresh-mlserve_staging]
• File[/var/log/cfssl-ocsprefresh-wikikube_staging]
• Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.timer]
• File[/etc/cfssl/signers/discovery2026/ca/discovery2026.pem]
• Systemd::Unit[cfssl-ocsprefresh-etcd.timer]
• Cfssl::Ocsp[syslog]
• Ferm::Rule[drop-blocked-nets]
• Systemd::Timer::Job[cfssl-ocsprefresh-network_devices]
• Systemd::Timer[cfssl-ocsprefresh-aux]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)]
• File[/etc/apache2/mods-enabled/status.conf]
• File[/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry]
• Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy]
• Sudo::User[nrpe-check_check_certificate_expiry_network_devices]
• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]
• Sudo::User[nrpe-check_check_certificate_expiry_zuul]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
• Class[Ulogd]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)]
• Ferm::Service[csr_and_ocsp_responder]
• Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet refresh]
• File[/etc/cfssl/signers/wikikube/cfssl.conf]
• Sudo::User[nrpe-check_ferm_active]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery]
• Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service]
• Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh]
• Cfssl::Signer[mlserve_staging]
• File[/etc/cfssl/db.conf.json]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery2026]
• File[/lib/systemd/system/cfssl-ocspserve@kafka.service]
• Logrotate::Conf[cfssl-ocsprefresh-etcd]
• Nrpe::Check[check_check_certificate_expiry_wikikube]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]
• Service[cfssl-ocspserve@cloud_wmnet_ca]
• Sudo::User[nrpe_certificate_check_syslog]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]
• Profile::Pki::Multirootca::Monitoring[cloud_wmnet_ca]
• Sudo::User[nrpe-check_check_certificate_expiry_dse_front_proxy]
• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.timer]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf]
• Systemd::Unit[cfssl-ocspserve@wikikube_front_proxy]
• File[/lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service]
• Nrpe::Monitor_service[check_certificate_expiry_aux]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_syslog]
• File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service]
• Package[links]
• File[/etc/cfssl/ocsp/wikikube_staging.ocsp]
• Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service]
• Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging]
• Logrotate::Conf[ulogd]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]
• Exec[ensure_present_mod_ssl]
• File[/etc/logrotate.d/cfssl-ocsprefresh-aux]
• Systemd::Service[cfssl-ocsprefresh-cloud_wmnet_ca]
• File[/etc/sudoers.d/nrpe_certificate_check_wikikube]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)]
• Firewall::Service[csr_and_ocsp_responder]
• File[/etc/cfssl/signers/dse]
• Exec[renew certificate - OCSP_syslog_pki1001_eqiad_wmnet]
• Profile::Pki::Multirootca::Monitoring[puppet_rsa]
• Cfssl::Config[mlserve_staging]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
• File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer]
• File[/lib/systemd/system/cfssl-gc-expired-certs.timer]
• Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging]
• File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr]
• Exec[ensure_present_mod_filter]
• Monitoring::Service[ferm_active]
• Systemd::Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
• Systemd::Unit[cfssl-ocsprefresh-zuul.timer]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]
• Systemd::Timer::Job[cfssl-ocsprefresh-kafka]
• File[/etc/update-motd.d/05-pki--multirootca]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_debmonitor]
• Service[cfssl-ocsprefresh-mlserve_front_proxy.timer]
• Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]
• File[/lib/systemd/system/cfssl-ocsprefresh-syslog.timer]
• File[/lib/systemd/system/cfssl-ocsprefresh-etcd.timer]
• Profile::Pki::Multirootca::Monitoring[aux]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube]
• Systemd::Service[wmf_auto_restart_apache-htcacheclean]
• Service[nrpe2nodexp-check_certificate_expiry_syslog.timer]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]
• File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr]
• Exec[renew certificate - OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
• File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem]
• File[/usr/local/lib/nagios/plugins/check_ferm]
• Systemd::Timer[cfssl-ocsprefresh-mlserve_staging]
• Exec[Generate initial CRL for aux]
• Nrpe::Check[check_check_certificate_expiry_cloud_wmnet_ca]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_puppet_rsa.prom]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]
• Systemd::Timer[wmf_auto_restart_ulogd2]
• Cfssl::Cert[OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
• File[/etc/rsyslog.d/40-wmf-auto-restart-apache2.conf]
• File[/etc/ferm/functions.conf]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf]
• Cfssl::Signer[etcd]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]
• File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]
• Systemd::Unit[cfssl-ocspserve@zuul]
• Service[cfssl-ocspserve@wikikube_front_proxy]
• Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf]
• File[/etc/logrotate.d/cfssl-ocsprefresh-etcd]
• File[/etc/rsyslog.d/40-ulogd.conf]
• Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
• Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
• Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
• Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.timer]
• File[/etc/cfssl/signers/debmonitor]
• Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet]
• File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
• Systemd::Service[wmf_auto_restart_apache2]
• Systemd::Service[cfssl-ocspserve@mlserve_staging]
• File[/etc/cfssl/ocsp/discovery2026.ocsp]
• Profile::Auto_restarts::Service[apache2]
• Cfssl::Cert[OCSP_mlserve_staging_pki1001_eqiad_wmnet]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.timer]
• File[/srv/cfssl/bundles/discovery.pem]
• File[/var/log/cfssl-ocsprefresh-etcd]
• Service[cfssl-ocsprefresh-cassandra.timer]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)]
• File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf]
• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
• Cfssl::Config[aux_front_proxy]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_front_proxy.prom]
• Systemd::Unit[cfssl-ocspserve@cloud_wmnet_ca]
• Systemd::Unit[cfssl-ocspserve@etcd]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
• Systemd::Timer[cfssl-ocsprefresh-aux_front_proxy]
• File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]
• File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service]
• File[/etc/cfssl/signers/zuul/ca]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)]
• File[/etc/ferm/ferm.conf]
• Nrpe::Monitor_service[check_certificate_expiry_wikikube_front_proxy]
• File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca]
• File[/srv/cfssl/bundles]
• Exec[renew certificate - OCSP_wikikube_pki1001_eqiad_wmnet]
• Exec[Generate initial CRL for aux_front_proxy]
• Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)]
• Nrpe::Monitor_service[check_certificate_expiry_cloud_wmnet_ca]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]
• Exec[Generate initial CRL for dse_front_proxy]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)]
• Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]
• File[/lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca]
• Cfssl::Cert[OCSP_discovery_pki1001_eqiad_wmnet]
• File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy]
• Systemd::Syslog[wmf_auto_restart_apache2]
• Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)]
• File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
• File[/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf]
• File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]
• Systemd::Timer::Job[cfssl-ocsprefresh-zuul]
• File[/etc/cfssl/signers/mlserve_staging_front_proxy]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
• File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging_front_proxy]
• File[/etc/cfssl/signers/kafka/cfssl.conf]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]
• Prometheus::Alert::Rule[check_check_certificate_expiry_debmonitor_224e2ac3574a9ce482218106d95a2931]
• Service[nrpe2nodexp-check_cfssl-multirootca_status.timer]
• Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]
• Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
• Systemd::Unit[nrpe2nodexp-ferm_active.timer]
• Prometheus::Alert::Rule[check_check_certificate_expiry_cassandra_f5e260f525c48c963fb2e6c86a0d5d63]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)]
• File[/etc/cfssl/signers/aux/ca/aux-key.pem]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
• Systemd::Service[nrpe2nodexp-check_cfssl-multirootca_status]
• File[/lib/systemd/system/cfssl-ocspserve@wikikube.service]
• Cfssl::Cert[OCSP_mlserve_pki1001_eqiad_wmnet]
• Systemd::Service[cfssl-ocspserve@etcd]
• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
• Sudo::User[nrpe-check_check_certificate_expiry_dse]
• Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg]
• Prometheus::Alert::Rule[check_check_certificate_expiry_network_devices_21dac3775d059b8c991626e2ca33f951]
• Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]
• File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem]
• File_line[auto_restart_file_presence_apache-htcacheclean]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
• Systemd::Service[cfssl-ocsprefresh-wikikube_staging_front_proxy]
• Systemd::Unit[cfssl-ocsprefresh-kafka.timer]
• File[/var/log/wmf_auto_restart_ulogd2]
• Prometheus::Blackbox::Check::Http[PKI_aux_front_proxy]
• File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr]
• File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging.service]
• Monitoring::Service[check_certificate_expiry_debmonitor]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]
• Prometheus::Node_textfile[prometheus-check-kafka-certificate-expiry]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]
• Systemd::Unit[cfssl-ocsprefresh-debmonitor.service]
• File[/etc/cfssl/signers/dse/ca/dse-key.pem]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)]
• File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging]
• File[/etc/rsyslog.d/40-cfssl-gc-expired-certs.conf]
• File[/lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service]
• Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]
• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem]
• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube]
• Nrpe::Monitor_service[check_certificate_expiry_discovery2026]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]
• Systemd::Timer::Job[nrpe2nodexp-ferm_active]
• Cfssl::Config[mlserve_staging_front_proxy]
• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem]
• Prometheus::Node_textfile[prometheus-check-network_devices-certificate-expiry]
• File[/usr/local/bin/prometheus-check-syslog-certificate-expiry]
• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
• Cfssl::Config[debmonitor]
• Systemd::Unit[cfssl-gc-expired-certs.service]
• File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
• Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.timer]
• Nrpe::Check[check_check_certificate_expiry_network_devices]
• Nrpe::Monitor_service[ferm_active]
• File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem]
• Class[Role::Pki::Multirootca]
• Prometheus::Blackbox::Check::Http[PKI_puppet_rsa]
• Sudo::User[nrpe-check_check_certificate_expiry_debmonitor]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]
• File[/etc/cfssl/signers/wikikube_front_proxy/ca]
• Prometheus::Node_textfile[prometheus-check-dse-certificate-expiry]
• Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh]
• Systemd::Service[cfssl-ocsprefresh-aux]
• Monitoring::Service[check_cfssl-multirootca_status]
• Logrotate::Conf[cfssl-ocsprefresh-discovery2026]
• File[/usr/local/bin/prometheus-check-discovery-certificate-expiry]
• Exec[Generate initial CRL for mlserve_staging]
• File[/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
• File[/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem]
• Profile::Pki::Multirootca::Monitoring[mlserve]
• Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service]
• Cfssl::Cert[OCSP_zuul_pki1001_eqiad_wmnet]
• Prometheus::Node_textfile[prometheus-check-debmonitor-certificate-expiry]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf]
• Systemd::Unit[cfssl-ocsprefresh-mlserve.service]
• Systemd::Unit[cfssl-ocsprefresh-network_devices.service]
• File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
• Nrpe::Check[check_check_certificate_expiry_cassandra]
• Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
• Systemd::Timer[cfssl-ocsprefresh-syslog]
• Sudo::User[nrpe_certificate_check_wikikube]
• Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
• Logrotate::Conf[cfssl-ocsprefresh-kafka]
• Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]
• Service[nrpe2nodexp-check_certificate_expiry_mlserve.timer]
• File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
• Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.timer]
• Systemd::Service[cfssl-ocspserve@wikikube]
• Monitoring::Service[check_certificate_expiry_zuul]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]
• File[/lib/systemd/system/cfssl-ocsprefresh-syslog.service]
• Sudo::User[nrpe-check_check_certificate_expiry_aux]
• File[/etc/sudoers.d/nrpe_certificate_check_aux_front_proxy]
• Systemd::Service[cfssl-multirootca]
• Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.timer (nrpe2nodexp-ferm_active.timer)]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer]
• Cfssl::Cert[OCSP_wikikube_staging_pki1001_eqiad_wmnet]
• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer]
• Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]
• File[/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf]
• Systemd::Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
• Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)]
• Service[cfssl-ocsprefresh-mlserve_staging.timer]
• File[/etc/apache2/conf-enabled]
• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
• Cfssl::Cert[OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
• File[/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_kafka]
• File[/lib/systemd/system/cfssl-ocsprefresh-etcd.service]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_syslog.prom]
• Systemd::Timer[cfssl-ocsprefresh-debmonitor]
• File[/etc/cfssl/signers/cassandra/ca]
• Service[nrpe2nodexp-check_certificate_expiry_kafka.timer]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf]
• Sudo::User[nrpe-check_check_certificate_expiry_etcd]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)]
• Cfssl::Cert[OCSP_discovery2026_pki1001_eqiad_wmnet]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom]
• Exec[ensure_present_mod_proxy_http]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg]
• File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr]
• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)]
• Systemd::Service[cfssl-ocsprefresh-syslog]
• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
• Systemd::Syslog[cfssl-ocsprefresh-mlserve_front_proxy]
• Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
• Service[cfssl-ocspserve@mlserve]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf]
• Systemd::Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
• Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet]
• Prometheus::Alert::Rule[check_check_certificate_expiry_syslog_e3b9b989d5062ce2d267023dfe42fcd8]
• File[/etc/cfssl/signers/etcd]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse]
• File[/srv/cfssl/bundles/syslog.pem]
• Monitoring::Exported_nagios_service[pki1001 ferm_active]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
• File[/var/log/ulogd]
• Logrotate::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
• Cfssl::Ocsp[puppet_rsa]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_front_proxy.prom]
• Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging_front_proxy]
• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
• Rsyslog::Conf[cfssl-ocsprefresh-wikikube]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)]
• File[/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry]
• File[/lib/systemd/system/cfssl-ocsprefresh-kafka.timer]
• Exec[Generate initial CRL for cloud_wmnet_ca]
• Systemd::Unit[apache2-apache2-after-network-online-target]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]
• Rsyslog::Conf[cfssl-ocsprefresh-discovery]
• Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
• Systemd::Unit[cfssl-ocsprefresh-syslog.timer]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]
• File[/etc/cfssl/signers/etcd/ca/etcd-key.pem]
• File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging.prom]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse]
• Cfssl::Ocsp[aux]
• File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer]
• Systemd::Service[cfssl-ocsprefresh-puppet_rsa]
• Nrpe::Check[check_check_cfssl-multirootca_status]
• Monitoring::Service[check_certificate_expiry_aux]
• File[/etc/cfssl/signers/wikikube_staging]
• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem]
• Systemd::Timer[wmf_auto_restart_apache2]
• Systemd::Unit[cfssl-multirootca]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)]
• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_front_proxy]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]
• Sudo::User[nrpe-check_check_certificate_expiry_syslog]
• Rsyslog::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse.prom]
• File[/etc/logrotate.d/cfssl-ocsprefresh-debmonitor]
• Systemd::Service[cfssl-ocspserve@kafka]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf]
• Cfssl::Cert[OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
• File[/etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf]
• File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
• File[/etc/apache2/ports.conf]
• Systemd::Service[wmf_auto_restart_ulogd2]
• Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]
• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg]
• Cfssl::Signer[network_devices]
• Service[wmf_auto_restart_apache-htcacheclean.timer]
• Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet refresh]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer]
• File[/etc/cfssl/signers/zuul/ca/zuul.pem]
• Monitoring::Service[check_certificate_expiry_network_devices]
• Monitoring::Service[check_certificate_expiry_aux_front_proxy]
• File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy]
• File[/etc/sudoers.d/nrpe_certificate_check_dse]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.timer]
• Profile::Pki::Multirootca::Monitoring[wikikube]
• File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem]
• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve]
• Cfssl::Signer[dse_front_proxy]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.timer]
• Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet]
• Cfssl::Config[wikikube]
• Nrpe::Monitor_service[check_certificate_expiry_discovery]
• Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]
• Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]
• Systemd::Unit[cfssl-ocsprefresh-aux.timer]
• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
• File[/srv/cfssl/bundles/cloud_wmnet_ca.pem]
• Logrotate::Conf[wmf_auto_restart_apache-htcacheclean]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer]
• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]
• File[/etc/cfssl/ocsp/kafka.ocsp]
• File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem]
• Systemd::Timer::Job[cfssl-ocsprefresh-etcd]
• File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem]
• Exec[Generate initial CRL for mlserve_staging_front_proxy]
• Profile::Pki::Multirootca::Monitoring[zuul]
• Rsyslog::Conf[cfssl-ocsprefresh-discovery2026]
• File[/etc/logrotate.d/cfssl-ocsprefresh-dse]
• Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging]
• Exec[renew certificate - OCSP_zuul_pki1001_eqiad_wmnet]
• File[/etc/cfssl/signers/puppet_rsa/ca]
• Profile::Pki::Multirootca::Monitoring[wikikube_staging]
• File[/etc/cfssl/signers/etcd/ca]
• Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service]
• File[/var/log/wmf_auto_restart_apache2]
• Exec[renew certificate - OCSP_discovery2026_pki1001_eqiad_wmnet]
• Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
• Cfssl::Cert[OCSP_network_devices_pki1001_eqiad_wmnet]
• Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]
• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux]
• File[/etc/cfssl/signers/mlserve/cfssl.conf]
• Systemd::Syslog[cfssl-ocsprefresh-zuul]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf]
• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
• Monitoring::Service[check_certificate_expiry_mlserve_front_proxy]
• File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
• File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]
• Systemd::Timer[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]
• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem]
• Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf]
• Prometheus::Node_textfile[prometheus-check-aux_front_proxy-certificate-expiry]
• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer]
• Systemd::Unit[cfssl-ocspserve@syslog]
• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)]
• Cfssl::Signer[puppet_rsa]
• File[/etc/cfssl/ssl/ocsp]
• Systemd::Service[cfssl-ocsprefresh-zuul]
• Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]
• Cfssl::Ocsp[etcd]

Resources modified

• Cfssl::Db[multirootca-db]

  Parameters differences:

  --- Cfssl::Db[multirootca-db].orig
  +++ Cfssl::Db[multirootca-db]
  
  -    ssl_checkhostname => False
  -    python_config     => True
  -    port              => 3306
  -    password          => changeme
  -    dbcharset         => utf8mb4
  -    host              => m1-master.eqiad.wmnet
  -    conf_file         => /etc/cfssl/db.conf
  -    ssl_ca            => /etc/ssl/certs/wmf-ca-certificates.crt
  -    dbname            => pki
  -    notify_service    => cfssl-multirootca
  -    driver            => mysql
  -    username          => pki
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-dse_front_proxy
  -
  -/var/log/cfssl-ocsprefresh-dse_front_proxy/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Systemd::Syslog[cfssl-ocsprefresh-mlserve]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-mlserve].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-mlserve]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Systemd::Syslog[wmf_auto_restart_ulogd2]

  Parameters differences:

  --- Systemd::Syslog[wmf_auto_restart_ulogd2].orig
  +++ Systemd::Syslog[wmf_auto_restart_ulogd2]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_mlserve]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem

• Prometheus::Blackbox::Check::Http[PKI_wikikube_staging_front_proxy]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_wikikube_staging_front_proxy].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_wikikube_staging_front_proxy]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"wikikube_staging_front_proxy"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• File[/var/lib/prometheus/node.d/role_owner.prom]

  Content differences:

  --- /var/lib/prometheus/node.d/role_owner.prom.orig
  +++ /var/lib/prometheus/node.d/role_owner.prom
  @@ -1,3 +1,3 @@
   # HELP role_owner The team owner of the server role
   # TYPE role_owner gauge
  -role_owner{team="infrastructure-foundations",role="pki::multirootca",cluster="pki"} 1.0
  +role_owner{team="infrastructure-foundations",role="insetup::infrastructure_foundations_nftables",cluster="insetup"} 1.0

• File[/etc/cfssl/signers/wikikube_staging/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_staging/ca].orig
  +++ File[/etc/cfssl/signers/wikikube_staging/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Sudo::User[nrpe-check_check_certificate_expiry_mlserve]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_mlserve].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_mlserve]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem']
  -    tag        => nrpe::check
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-kafka-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-kafka-certificate-expiry --cert-path /etc/cfssl/signers/kafka/ca/kafka.pem --outfile /var/lib/prometheus/node.d/kafka_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Systemd::Service[cfssl-ocsprefresh-mlserve]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-mlserve].orig
  +++ Systemd::Service[cfssl-ocsprefresh-mlserve]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-mlserve.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_syslog.service
  

• File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-cassandra.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-cassandra.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - cassandra
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/cassandra/ca/cassandra.pem --responses-file /etc/cfssl/ocsp/cassandra.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@cassandra' cassandra 

• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-wikikube_front_proxy.timer]']
  -    refreshonly => True
  

• File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp]

  Parameters differences:

  --- File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp].orig
  +++ File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp]
  
  -    notify  => Service[ferm]
  -    require => File[/etc/ferm/conf.d]
  -    ensure  => present
  -    owner   => root
  -    tag     => ferm
  -    mode    => 0400
  -    group   => root
  

  Content differences:

  --- /etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp.orig
  +++ /etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp
  @@ -1,6 +0,0 @@
  -# Autogenerated by puppet. DO NOT EDIT BY HAND!
  -#
  -# 
  -&R_SERVICE(tcp, 1:65535, (10.64.0.82 10.64.16.62 10.64.32.85 10.64.48.171 208.80.153.42 208.80.154.78 2620:0:860:2:208:80:153:42 2620:0:861:101:10:64:0:82 2620:0:861:102:10:64:16:62 2620:0:861:103:10:64:32:85 2620:0:861:107:10:64:48:171 2620:0:861:3:208:80:154:78));
  -
  -

• Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-cassandra.timer]']
  -    refreshonly => True
  

• Concat_fragment[main contacts]

  Content differences:

  --- main contacts.orig
  +++ main contacts
  @@ -1,3 +1,3 @@
   ---
  -role::pki::multirootca:
  +role::insetup::infrastructure_foundations_nftables:
   - Infrastructure Foundations

• Sudo::User[nrpe_certificate_check_etcd]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_etcd].orig
  +++ Sudo::User[nrpe_certificate_check_etcd]
  
  -    user       => nrpe_certificate_check_etcd
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• Service[wmf_auto_restart_ulogd2.timer]

  Parameters differences:

  --- Service[wmf_auto_restart_ulogd2.timer].orig
  +++ Service[wmf_auto_restart_ulogd2.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/cfssl/signers/debmonitor/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/debmonitor/ca].orig
  +++ File[/etc/cfssl/signers/debmonitor/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Nrpe::Plugin[check_ferm]

  Parameters differences:

  --- Nrpe::Plugin[check_ferm].orig
  +++ Nrpe::Plugin[check_ferm]
  
  -    source => puppet:///modules/base/firewall/check_ferm
  -    ensure => present
  

• Service[cfssl-ocspserve@aux]

  Parameters differences:

  --- Service[cfssl-ocspserve@aux].orig
  +++ Service[cfssl-ocspserve@aux]
  
  -    ensure => running
  -    enable => True
  

• File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft.orig
  +++ /etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft
  @@ -0,0 +1,7 @@
  +# Autogenerated by puppet
  +set KAFKAMON_HOSTS_ipv4 {
  +    type ipv4_addr
  +    elements = { 10.64.32.11,
  +             10.192.16.139
  +    }
  +}

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux_front_proxy.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux_front_proxy.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux_front_proxy.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Systemd::Timer[cfssl-ocsprefresh-discovery2026]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-discovery2026].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-discovery2026]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-discovery2026.service
  

• File[/etc/nftables/forward]

  Parameters differences:

  --- File[/etc/nftables/forward].orig
  +++ File[/etc/nftables/forward]
  
  +    ensure  => directory
  +    purge   => True
  +    recurse => True
  +    owner   => root
  +    group   => root
  

• Nftables::Set[FRACK_NETWORKS]

  Parameters differences:

  --- Nftables::Set[FRACK_NETWORKS].orig
  +++ Nftables::Set[FRACK_NETWORKS]
  
  +    hosts  => ['10.195.0.0/27', '10.195.0.128/29', '10.195.0.32/27', '10.195.0.64/28', '10.195.0.80/29', '10.195.0.96/27', '10.195.1.0/25', '10.64.40.0/27', '10.64.40.160/27', '10.64.40.192/26', '10.64.40.32/27', '10.64.40.64/27', '10.64.40.96/27', '208.80.152.224/28', '208.80.155.0/27']
  +    ensure => present
  

• Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-wikikube_staging.timer
  

• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Sudo::User[nrpe_certificate_check_debmonitor]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_debmonitor].orig
  +++ Sudo::User[nrpe_certificate_check_debmonitor]
  
  -    user       => nrpe_certificate_check_debmonitor
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Systemd::Unit[cfssl-ocspserve@mlserve]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@mlserve].orig
  +++ Systemd::Unit[cfssl-ocspserve@mlserve]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@mlserve
  

• File[/etc/cfssl/ocsp/mlserve_staging.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/mlserve_staging.ocsp].orig
  +++ File[/etc/cfssl/ocsp/mlserve_staging.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
  

• Systemd::Timer[cfssl-ocsprefresh-mlserve]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-mlserve].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-mlserve]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-mlserve.service
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: mlserve_staging
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_mlserve_staging!10
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_syslog]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_syslog].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_syslog]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (mlserve_staging_front_proxy)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 20041 \
  -          -responses /etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Timer[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse_front_proxy.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse_front_proxy.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse_front_proxy.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Cfssl::Config[dse]

  Parameters differences:

  --- Cfssl::Config[dse].orig
  +++ Cfssl::Config[dse]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/dse/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/dse
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/dse
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages      => ['signing', 'key encipherment', 'client auth']
  

• File[/lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (aux_front_proxy)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 20051 \
  -          -responses /etc/cfssl/ocsp/aux_front_proxy.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_syslog command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_syslog
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "e3b9b989d5062ce2d267023dfe42fcd8" --timeout 10 --check-command "check_check_certificate_expiry_syslog"

• File[/lib/systemd/system/cfssl-ocspserve@network_devices.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@network_devices.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@network_devices.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@network_devices.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@network_devices.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (network_devices)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 20063 \
  -          -responses /etc/cfssl/ocsp/network_devices.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer
  

• File[/srv/cfssl/bundles/cassandra.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/cassandra.pem].orig
  +++ File[/srv/cfssl/bundles/cassandra.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/cassandra.pem.orig
  +++ /srv/cfssl/bundles/cassandra.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDqjCCAw2gAwIBAgIUN8PPoG0JeyUfDWKQhN0B2AOw4G8wCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjE5MTI1MDAwWhcNMjgwNjE3MTI1MDAwWjB3
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRIwEAYDVQQDEwljYXNzYW5kcmEwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
  -BABpd+xtElegZM2bsg1caGxmHV5hs7l7qxmKFS3oSAu1jo1+N/uSppDtSWZzG+8C
  -zjIrytBMxBWhNqsOw9msEWhbBAEYESw1oKj+APqOlCafGdXQI1ZvMafexxTqDNN1
  -CA2gq4ivn82r2Ya3LLqwICxK3MlcmGuLwR5amxiLchok3cZ3X6OCAQwwggEIMA4G
  -A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQBN6m6
  -eyaSV8l2Il/bwcfpWTmplDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
  -NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
  -ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
  -BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
  -ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GKADCBhgJBRhCSOg5L
  -+EuYGdsW8T9S/tXzYURZpnQItn2nYjM6ky1nxqG6F+V2WsiijiPpEQxr7QUvfZhf
  -D2zhB5BS8ynWCpYCQRGo4eZuUHyRMNqg/ZDljT1dqr09n0wQhszrJ4eCmebLVsDm
  -B6AM3pPRygYo0REwxHbpTBAIt26zjGiKiFQqUjwa
  ------END CERTIFICATE-----

• File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Ferm::Service[full_monitoring_metrics_access_tcp]

  Parameters differences:

  --- Ferm::Service[full_monitoring_metrics_access_tcp].orig
  +++ Ferm::Service[full_monitoring_metrics_access_tcp]
  
  -    srange              => ['prometheus1005.eqiad.wmnet', 'prometheus1006.eqiad.wmnet', 'prometheus1007.eqiad.wmnet', 'prometheus1008.eqiad.wmnet', '208.80.154.78', '2620:0:861:3:208:80:154:78', '208.80.153.42', '2620:0:860:2:208:80:153:42']
  -    ensure              => present
  -    prio                => 10
  -    desc                => 
  -    port_range          => [1, 65535]
  -    proto               => tcp
  -    unrestricted_access => False
  -    notrack             => False
  

• Prometheus::Blackbox::Check::Http[PKI_network_devices]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_network_devices].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_network_devices]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"network_devices"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Systemd::Unit[cfssl-ocspserve@cassandra]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@cassandra].orig
  +++ Systemd::Unit[cfssl-ocspserve@cassandra]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@cassandra
  

• File[/etc/apache2/mods-available/status.conf]

  Parameters differences:

  --- File[/etc/apache2/mods-available/status.conf].orig
  +++ File[/etc/apache2/mods-available/status.conf]
  
  -    require => Package[apache2]
  -    ensure  => absent
  -    owner   => root
  -    before  => Httpd::Mod_conf[status]
  -    group   => root
  

• File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem].orig
  +++ File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem.orig
  +++ /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem
  @@ -1 +0,0 @@
  -test

• Systemd::Service[cfssl-ocsprefresh-kafka]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-kafka].orig
  +++ Systemd::Service[cfssl-ocsprefresh-kafka]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-kafka.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem

• Exec[Generate initial CRL for wikikube]

  Parameters differences:

  --- Exec[Generate initial CRL for wikikube].orig
  +++ Exec[Generate initial CRL for wikikube]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/wikikube/ca/wikikube.pem /etc/cfssl/signers/wikikube/ca/wikikube-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/wikikube
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/wikikube
  

• Prometheus::Blackbox::Check::Http[PKI_mlserve_front_proxy]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_mlserve_front_proxy].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_mlserve_front_proxy]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"mlserve_front_proxy"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_front_proxy_9d6dd05c8e5e1bb294462d932b24bd1a]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_front_proxy_9d6dd05c8e5e1bb294462d932b24bd1a].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_front_proxy_9d6dd05c8e5e1bb294462d932b24bd1a]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_front_proxy
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="9d6dd05c8e5e1bb294462d932b24bd1a",check_name="check_check_certificate_expiry_mlserve_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__mlserve_front_proxy
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_front_proxy
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_mlserve_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• File[/etc/cfssl/signers/debmonitor/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/debmonitor/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/debmonitor/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/debmonitor/cfssl.conf.orig
  +++ /etc/cfssl/signers/debmonitor/cfssl.conf
  @@ -1,64 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "signing",
  -        "key encipherment",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/debmonitor",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/debmonitor"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Sudo::User[nrpe_certificate_check_zuul]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_zuul].orig
  +++ Sudo::User[nrpe_certificate_check_zuul]
  
  -    user       => nrpe_certificate_check_zuul
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_staging_front_proxy command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "e515778a769f523fb98a7f642670e011" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_staging_front_proxy"

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/cfssl/ocsp/zuul.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/zuul.ocsp].orig
  +++ File[/etc/cfssl/ocsp/zuul.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_front_proxy]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_front_proxy].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_front_proxy]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: wikikube_front_proxy
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_wikikube_front_proxy!10
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Systemd::Unit[prometheus-node-textfile-check-nft.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-check-nft.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-check-nft.timer]
  
  +    require           => ['Class[Systemd]']
  +    override_filename => puppet-override.conf
  +    ensure            => present
  +    override          => False
  +    restart           => False
  +    unit              => prometheus-node-textfile-check-nft.timer
  

• Systemd::Service[cfssl-ocsprefresh-mlserve_staging_front_proxy]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
  +++ Systemd::Service[cfssl-ocsprefresh-mlserve_staging_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Ferm::Conf[main]

  Parameters differences:

  --- Ferm::Conf[main].orig
  +++ Ferm::Conf[main]
  
  -    prio   => 02
  -    source => puppet:///modules/base/firewall/main-input-default-drop.conf
  -    ensure => present
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
  

• File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem].orig
  +++ File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem.orig
  +++ /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDsjCCAxOgAwIBAgIUcL3aZt8/kOKuFw8g90SCOk9VZSYwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjB9
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRgwFgYDVQQDDA9hdXhfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
  -ACMDgYYABAFQamNeMXOM8jZDTMiL/0Cgk641Tps3tMBQ6f1OD7fqLh7JGWZXSWIE
  -9v25H6dgcqSIWAlvBkbHQUPU51GmXigXtwCW1bYWFZc+MTjXFo2LBUJVUIxh2mh3
  -pNZYlgVZXP7a0l3zt2u5vegKRuJ6l0ELtjCJjo/TNYo/BA28XrzCL45HO6OCAQww
  -ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
  -BBQv7ovDzaQTat1sfWJFkZ+n8+aGSTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
  -g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
  -ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
  -SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
  -L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
  -AZ7oTip5kp2Yt9BABNEqYi6GjwpXZvmZOgd6So8UA76jP8duYicuOoNvpoHdEy58
  -ZOGpo0lqqIzB8xQcvzvmX7uiAkIAxHVKylOLCoPsUXaZVfUGhNavXXwrbIHTQXDo
  -HEHmc9lIMh9hO5z4vPMEbMkSRuAskcT1K/ydEqp4xI191jnovUg=
  ------END CERTIFICATE-----

• File[/lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (cloud_wmnet_ca)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 10004 \
  -          -responses /etc/cfssl/ocsp/cloud_wmnet_ca.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/srv/cfssl/bundles/dse_front_proxy.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/dse_front_proxy.pem].orig
  +++ File[/srv/cfssl/bundles/dse_front_proxy.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/dse_front_proxy.pem.orig
  +++ /srv/cfssl/bundles/dse_front_proxy.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDsjCCAxOgAwIBAgIUBGeKXglKnoXGyRgWodaHSfz0z/gwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjB9
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRgwFgYDVQQDDA9kc2VfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
  -ACMDgYYABAGUNx07sN1MWk3DzjEFh3pfYaQVrqo1tWFQjf7URfwqfyZY81Tqt6yl
  -y/zj3DpvtOmvyI5jPH91yPBaFho0/SpP6wFkBIyE8/Ik2b80slPKuzstrYgBlYsG
  -+Fxop4CYWjLItOy1Ut82aYr76hNm0goEma9ETjgE4nfBEU3vi77QO/B9E6OCAQww
  -ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
  -BBQPHxMmkuy8EqO+Wz7TmM1MfmcXDDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
  -g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
  -ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
  -SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
  -L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
  -AO3JNb9OyC3JQ3mmkgt+Db3NMgLArYlvcYd8Nd5uWEXm6d6NfUPDN5XBGkjly1B7
  -N18vKQYxlZzX2wgYqaK9LYs9AkIBch3vTND/M2T78Hhp5YoodasCdLDcpMJ1Qn3T
  -fI0Lwjt7W50T0FMle6CwZkI+ZrxRzqvic19IUSTDDqwiOFgLhqM=
  ------END CERTIFICATE-----

• File[/etc/cfssl/signers/aux_front_proxy/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/aux_front_proxy/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/aux_front_proxy/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/aux_front_proxy/cfssl.conf.orig
  +++ /etc/cfssl/signers/aux_front_proxy/cfssl.conf
  @@ -1,64 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "signing",
  -        "key encipherment",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/aux_front_proxy",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/aux_front_proxy"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Cfssl::Cert[OCSP_wikikube_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_wikikube_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_wikikube_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => wikikube
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@wikikube]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-wikikube]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_front_proxy_e515778a769f523fb98a7f642670e011]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_front_proxy_e515778a769f523fb98a7f642670e011].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_front_proxy_e515778a769f523fb98a7f642670e011]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="e515778a769f523fb98a7f642670e011",check_name="check_check_certificate_expiry_wikikube_staging_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__wikikube_staging_front_proxy
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_wikikube_staging_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• Exec[Generate initial CRL for wikikube_front_proxy]

  Parameters differences:

  --- Exec[Generate initial CRL for wikikube_front_proxy].orig
  +++ Exec[Generate initial CRL for wikikube_front_proxy]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/wikikube_front_proxy
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/wikikube_front_proxy
  

• Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Cfssl::Config[kafka]

  Parameters differences:

  --- Cfssl::Config[kafka].orig
  +++ Cfssl::Config[kafka]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/kafka/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/kafka
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/kafka
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'kafka_11': {'expiry': '8760h'}}
  -    default_usages      => ['digital signature', 'key encipherment', 'server auth', 'client auth']
  

• Exec[renew certificate - OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_dse]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem

• Cfssl::Cert[OCSP_debmonitor_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_debmonitor_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_debmonitor_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => debmonitor
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@debmonitor]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• Systemd::Unit[nftables]

  Parameters differences:

  --- Systemd::Unit[nftables].orig
  +++ Systemd::Unit[nftables]
  
  +    require           => ['Class[Systemd]']
  +    override_filename => puppet-override.conf
  +    ensure            => present
  +    override          => True
  +    restart           => False
  +    unit              => nftables
  

• File[/etc/nftables/sets/MONITORING_HOSTS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/MONITORING_HOSTS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/MONITORING_HOSTS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/MONITORING_HOSTS_ipv4.nft.orig
  +++ /etc/nftables/sets/MONITORING_HOSTS_ipv4.nft
  @@ -0,0 +1,7 @@
  +# Autogenerated by puppet
  +set MONITORING_HOSTS_ipv4 {
  +    type ipv4_addr
  +    elements = { 208.80.154.78,
  +             208.80.153.42
  +    }
  +}

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_discovery2026]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem

• File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_udp]

  Parameters differences:

  --- File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_udp].orig
  +++ File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_udp]
  
  -    notify  => Service[ferm]
  -    require => File[/etc/ferm/conf.d]
  -    ensure  => present
  -    owner   => root
  -    tag     => ferm
  -    mode    => 0400
  -    group   => root
  

  Content differences:

  --- /etc/ferm/conf.d/10_full_monitoring_metrics_access_udp.orig
  +++ /etc/ferm/conf.d/10_full_monitoring_metrics_access_udp
  @@ -1,6 +0,0 @@
  -# Autogenerated by puppet. DO NOT EDIT BY HAND!
  -#
  -# 
  -&R_SERVICE(udp, 1:65535, (10.64.0.82 10.64.16.62 10.64.32.85 10.64.48.171 208.80.153.42 208.80.154.78 2620:0:860:2:208:80:153:42 2620:0:861:101:10:64:0:82 2620:0:861:102:10:64:16:62 2620:0:861:103:10:64:32:85 2620:0:861:107:10:64:48:171 2620:0:861:3:208:80:154:78));
  -
  -

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label syslog -profile ocsp /etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Cfssl::Signer[aux]

  Parameters differences:

  --- Cfssl::Signer[aux].orig
  +++ Cfssl::Signer[aux]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/aux/ca/aux.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDpjCCAwegAwIBAgIUB83dKT9lbMGOLf38Jx6fmsSa714wCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjBx
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMQwwCgYDVQQDEwNhdXgwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABADhzJSO
  h264ltJ1CVADYcfi1rIxQOY3gtAsxonZ6CWNueKg0vjvDeL32l+NZ3f2yj2CIzl5
  sa6sZjXmwAKziuuvCAHmsZDY5gzgBdwhZ6UeGAbwlLMgQajwRvCA2RUMuH8iAd6o
  QcfZyHQFb0zl9mCHYNkjLT4jpwrL4Lx/DGbmkE/ulqOCAQwwggEIMA4GA1UdDwEB
  /wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSPVQ8kSyOIH5l4
  1mVGCudJoaowtTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
  BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
  bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
  oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
  bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCALJuWafVNInsE4Q8
  tEHYHqhweF6bEArm7d3dqqTjKHuOcrmhXo4rgX5VsXHtI3qq9XGHoik6JUSwgftV
  Sr+GWrIZAkIAuqmJ5vv2LgFcJWvYDkIPH9HXB9rIwAUHPFJ/iX2Ig9By+ss8nJbU
  A3Ml/4NKRsXZwwyScmowVWQHfMpv53BsBv8=
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => nosecret
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/aux
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/aux
  -    ca_key_file      => /etc/cfssl/signers/aux/ca/aux-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages   => ['signing', 'key encipherment', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_aux.service
  

• Prometheus::Node_textfile[prometheus-check-syslog-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-syslog-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-syslog-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-syslog-certificate-expiry --cert-path /etc/cfssl/signers/syslog/ca/syslog.pem --outfile /var/lib/prometheus/node.d/syslog_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]']
  -    refreshonly => True
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]']
  -    refreshonly => True
  

• File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem].orig
  +++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]
  
  -    ensure => file
  -    owner  => root
  -    source => puppet:///modules/profile/pki/intermediates/puppet_rsa-cert.pem
  -    mode   => 0440
  -    group  => root
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_syslog.timer
  

• Systemd::Unmask[nftables.service]

  Parameters differences:

  --- Systemd::Unmask[nftables.service].orig
  +++ Systemd::Unmask[nftables.service]
  
  +    refreshonly => False
  +    unit        => nftables.service
  

• Systemd::Service[cfssl-ocspserve@mlserve_staging_front_proxy]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@mlserve_staging_front_proxy].orig
  +++ Systemd::Service[cfssl-ocspserve@mlserve_staging_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Monitoring::Service[check_certificate_expiry_cassandra]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_cassandra].orig
  +++ Monitoring::Service[check_certificate_expiry_cassandra]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: cassandra
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_cassandra!10
  

• File[/etc/cfssl/ocsp/aux.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/aux.ocsp].orig
  +++ File[/etc/cfssl/ocsp/aux.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_kafka]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_kafka].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_kafka]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: kafka
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_kafka!10
  

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
  
  -    ensure => present
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
  

• Concat::Fragment[main contacts]

• Exec[Generate cert puppet_rsa__pki_discovery_wmnet]

  Parameters differences:

  --- Exec[Generate cert puppet_rsa__pki_discovery_wmnet].orig
  +++ Exec[Generate cert puppet_rsa__pki_discovery_wmnet]
  
  -    notify      => ['Service[apache2]']
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa  /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem 2>&1)"
  
  

• File[/etc/cfssl/ocsp/wikikube.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/wikikube.ocsp].orig
  +++ File[/etc/cfssl/ocsp/wikikube.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/nftables/sets/LABS_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/LABS_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/LABS_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/LABS_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/LABS_NETWORKS_ipv6.nft
  @@ -0,0 +1,20 @@
  +# Autogenerated by puppet
  +set LABS_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2a02:ec80:a000:100::/64,
  +             2a02:ec80:a000:1::/64,
  +             2a02:ec80:a000:201::/64,
  +             2a02:ec80:a000:202::/64,
  +             2a02:ec80:a000:203::/64,
  +             2a02:ec80:a000:204::/64,
  +             2a02:ec80:a000:2ff::/64,
  +             2a02:ec80:a000:4000::/64,
  +             2a02:ec80:a100:100::/64,
  +             2a02:ec80:a100:1::/64,
  +             2a02:ec80:a100:205::/64,
  +             2a02:ec80:a100:2ff::/64,
  +             2a02:ec80:a100:4000::/64
  +    }
  +}

• Nrpe::Check[check_check_certificate_expiry_mlserve_staging]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_mlserve_staging].orig
  +++ Nrpe::Check[check_check_certificate_expiry_mlserve_staging]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
  -    before    => Monitoring::Service[check_certificate_expiry_mlserve_staging]
  -    ensure    => present
  -    sudo_user => root
  

• Rsyslog::Conf[cfssl-gc-expired-certs]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-gc-expired-certs].orig
  +++ Rsyslog::Conf[cfssl-gc-expired-certs]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-gc-expired-certs]
  -    ensure   => present
  -    mode     => 0444
  

• Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cassandra -profile ocsp /etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-dse_front_proxy-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --outfile /var/lib/prometheus/node.d/dse_front_proxy_intermediate.prom

• Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-puppet_rsa.timer]']
  -    refreshonly => True
  

• Cfssl::Ocsp[network_devices]

  Parameters differences:

  --- Cfssl::Ocsp[network_devices].orig
  +++ Cfssl::Ocsp[network_devices]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/network_devices/ca/network_devices.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 20063
  -    db_driver          => mysql
  

• File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr.orig
  +++ /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr
  @@ -1,14 +0,0 @@
  -{
  -  "CN": "pki.discovery.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet",
  -    "pki.discovery.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• File[/srv/cfssl/bundles/etcd.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/etcd.pem].orig
  +++ File[/srv/cfssl/bundles/etcd.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/etcd.pem.orig
  +++ /srv/cfssl/bundles/etcd.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDpzCCAwigAwIBAgIUOk3cFWirYBfYaO6q8zyqfEHxwVEwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjIwODEwMTAzODAwWhcNMjcwODA5MTAzODAwWjBy
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMQ0wCwYDVQQDEwRldGNkMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAgtdp
  -7nZHIAQhEm2IlJ7AzfGjWIGGzKzCfnBQ8d+euPiOZ3ccv1YXfx0f+WmV35vuEmA/
  -ZSw/6iJrKBnYsZAR6U0ByUUqg6nUYg4P47Sc/kMTWmVIgRuNhmrgavCK+qRQdnZs
  -N/OOGTgFNG0icty63dUF4NZz80HxHSrPQYaNxZ9ydY2jggEMMIIBCDAOBgNVHQ8B
  -Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUtvZYHyYnZHZP
  -ZLIB5kqPcVOVI9owHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
  -KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
  -bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
  -P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
  -SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgEgYyeOREniK9JC
  -4hvIiuv9D7mVVXzX5/s8GuhTbRadqZr41ulpHT53lFcbt+xhAsyqMxXPhgT/OyMQ
  -jkXuEh5oBQJCAM22xLZpt2XwKCp0opgXlC5fm5+YjKba2COlr43q78I2la57aYdp
  -UF7sFgBRFVx7FNY7CASuZMYsW+4wltPTXVau
  ------END CERTIFICATE-----

• Prometheus::Alert::Rule[check_check_certificate_expiry_kafka_22922fd6bc2d570e018cbe5ccd8d1727]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_kafka_22922fd6bc2d570e018cbe5ccd8d1727].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_kafka_22922fd6bc2d570e018cbe5ccd8d1727]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: kafka
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="22922fd6bc2d570e018cbe5ccd8d1727",check_name="check_check_certificate_expiry_kafka", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__kafka
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: kafka
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_kafka))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft
  @@ -0,0 +1,99 @@
  +# Autogenerated by puppet
  +set MW_APPSERVER_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 10.64.0.0/22,
  +             10.64.130.0/24,
  +             10.64.131.0/24,
  +             10.64.132.0/24,
  +             10.64.133.0/24,
  +             10.64.134.0/24,
  +             10.64.135.0/24,
  +             10.64.136.0/24,
  +             10.64.141.0/24,
  +             10.64.152.0/24,
  +             10.64.154.0/24,
  +             10.64.156.0/24,
  +             10.64.158.0/24,
  +             10.64.16.0/22,
  +             10.64.160.0/24,
  +             10.64.162.0/24,
  +             10.64.164.0/24,
  +             10.64.166.0/24,
  +             10.64.169.0/24,
  +             10.64.171.0/24,
  +             10.64.173.0/24,
  +             10.64.175.0/24,
  +             10.64.177.0/24,
  +             10.64.179.0/24,
  +             10.64.181.0/24,
  +             10.64.183.0/24,
  +             10.64.185.0/24,
  +             10.64.187.0/24,
  +             10.64.189.0/24,
  +             10.64.32.0/22,
  +             10.64.48.0/22,
  +             10.192.0.0/22,
  +             10.192.10.0/24,
  +             10.192.11.0/24,
  +             10.192.12.0/24,
  +             10.192.13.0/24,
  +             10.192.14.0/24,
  +             10.192.15.0/24,
  +             10.192.16.0/22,
  +             10.192.21.0/24,
  +             10.192.22.0/24,
  +             10.192.23.0/24,
  +             10.192.26.0/24,
  +             10.192.27.0/24,
  +             10.192.28.0/24,
  +             10.192.29.0/24,
  +             10.192.30.0/24,
  +             10.192.31.0/24,
  +             10.192.32.0/22,
  +             10.192.36.0/24,
  +             10.192.37.0/24,
  +             10.192.38.0/24,
  +             10.192.39.0/24,
  +             10.192.4.0/24,
  +             10.192.40.0/24,
  +             10.192.41.0/24,
  +             10.192.42.0/24,
  +             10.192.43.0/24,
  +             10.192.44.0/24,
  +             10.192.45.0/24,
  +             10.192.46.0/24,
  +             10.192.47.0/24,
  +             10.192.48.0/22,
  +             10.192.5.0/24,
  +             10.192.52.0/24,
  +             10.192.56.0/24,
  +             10.192.57.0/24,
  +             10.192.58.0/24,
  +             10.192.59.0/24,
  +             10.192.6.0/24,
  +             10.192.7.0/24,
  +             10.192.8.0/24,
  +             10.192.9.0/24,
  +             10.192.64.0/21,
  +             10.192.96.0/21,
  +             10.194.128.0/17,
  +             10.194.16.0/21,
  +             10.194.61.0/24,
  +             10.194.80.0/21,
  +             10.64.64.0/21,
  +             10.67.128.0/17,
  +             10.67.16.0/21,
  +             10.67.24.0/21,
  +             10.67.80.0/21,
  +             208.80.154.0/26,
  +             208.80.154.128/26,
  +             208.80.154.64/26,
  +             208.80.155.96/27,
  +             208.80.153.0/27,
  +             208.80.153.32/27,
  +             208.80.153.64/27,
  +             208.80.153.96/27
  +    }
  +}

• Nrpe::Check[check_check_certificate_expiry_aux]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_aux].orig
  +++ Nrpe::Check[check_check_certificate_expiry_aux]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem
  -    before    => Monitoring::Service[check_certificate_expiry_aux]
  -    ensure    => present
  -    sudo_user => root
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Systemd::Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA].orig
  +++ Systemd::Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Cfssl::Ocsp[mlserve_staging]

  Parameters differences:

  --- Cfssl::Ocsp[mlserve_staging].orig
  +++ Cfssl::Ocsp[mlserve_staging]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 20040
  -    db_driver          => mysql
  

• Nftables::Set[LOAD_BALANCER_HEALTH_CHECKS]

  Parameters differences:

  --- Nftables::Set[LOAD_BALANCER_HEALTH_CHECKS].orig
  +++ Nftables::Set[LOAD_BALANCER_HEALTH_CHECKS]
  
  +    hosts  => ['10.64.0.136', '10.64.16.60', '10.64.158.19', '10.64.166.19', '10.64.133.19', '10.64.141.19', '10.64.169.19', '10.64.171.19', '10.64.173.19', '10.64.175.19', '10.64.177.19', '10.64.179.19', '10.64.181.19', '10.64.183.19', '10.64.185.19', '10.64.187.19', '10.64.189.19', '10.64.48.72', '10.64.37.17', '10.64.1.17', '10.64.17.17', '10.64.33.17', '10.64.130.20', '10.64.131.20', '10.64.132.20', '10.64.134.20', '10.64.135.20', '10.64.136.20', '10.64.158.20', '10.64.166.20', '10.64.133.20', '10.64.141.20', '10.64.169.20', '10.64.171.20', '10.64.173.20', '10.64.175.20', '10.64.177.20', '10.64.179.20', '10.64.181.20', '10.64.183.20', '10.64.185.20', '10.64.187.20', '10.64.189.20', '2620:0:861:101::/64', '2620:0:861:102::/64', '2620:0:861:103::/64', '2620:0:861:107::/64', '2620:0:861:109::/64', '2620:0:861:10a::/64', '2620:0:861:10b::/64', '2620:0:861:10d::/64', '2620:0:861:10e::/64', '2620:0:861:10f::/64', '2620:0:861:119::/64', '2620:0:861:10c::/64', '2620:0:861:113::/64', '2620:0:861:119::/64', '2620:0:861:131::/64', '2620:0:861:133::/64', '2620:0:861:135::/64', '2620:0:861:137::/64', '2620:0:861:139::/64', '2620:0:861:13b::/64', '2620:0:861:13d::/64', '2620:0:861:13f::/64', '2620:0:861:142::/64', '2620:0:861:144::/64', '10.192.23.8', '10.192.0.29', '10.192.17.8', '10.192.33.8', '10.192.49.8', '10.192.23.2', '10.192.5.2', '10.192.6.2', '10.192.7.2', '10.192.8.2', '10.192.9.2', '10.192.10.2', '10.192.11.2', '10.192.12.2', '10.192.13.2', '10.192.14.2', '10.192.15.2', '10.192.21.2', '10.192.22.2', '10.192.4.2', '10.192.26.2', '10.192.27.2', '10.192.28.2', '10.192.29.2', '10.192.30.2', '10.192.31.2', '10.192.36.2', '10.192.37.2', '10.192.38.2', '10.192.39.2', '10.192.40.2', '10.192.41.2', '10.192.42.2', '10.192.43.2', '10.192.11.8', '10.192.16.140', '10.192.1.8', '10.192.33.9', '10.192.49.9', '10.192.23.3', '10.192.5.3', '10.192.6.3', '10.192.7.3', '10.192.8.3', '10.192.9.3', '10.192.10.3', '10.192.11.3', '10.192.12.3', '10.192.13.3', '10.192.14.3', '10.192.15.3', '10.192.21.3', '10.192.22.3', '10.192.4.3', '10.192.26.3', '10.192.27.3', '10.192.28.3', '10.192.29.3', '10.192.30.3', '10.192.31.3', '10.192.36.3', '10.192.37.3', '10.192.38.3', '10.192.39.4', '10.192.40.3', '10.192.41.3', '10.192.42.3', '10.192.43.3', '10.192.32.14', '10.192.1.9', '10.192.17.9', '10.192.49.10', '10.192.23.4', '10.192.5.4', '10.192.6.4', '10.192.7.4', '10.192.8.4', '10.192.9.4', '10.192.10.4', '10.192.11.4', '10.192.12.4', '10.192.13.4', '10.192.14.4', '10.192.15.4', '10.192.21.4', '10.192.22.4', '10.192.4.5', '10.192.26.5', '10.192.27.5', '10.192.28.5', '10.192.29.5', '10.192.30.5', '10.192.31.5', '10.192.36.5', '10.192.37.5', '10.192.38.5', '10.192.39.6', '10.192.40.5', '10.192.41.5', '10.192.42.5', '10.192.43.5', '10.192.48.213', '10.192.1.13', '10.192.17.10', '10.192.33.10', '10.192.23.5', '10.192.5.8', '10.192.6.5', '10.192.7.5', '10.192.8.5', '10.192.9.5', '10.192.10.5', '10.192.11.5', '10.192.12.5', '10.192.13.5', '10.192.14.5', '10.192.15.5', '10.192.21.5', '10.192.22.5', '10.192.4.5', '10.192.26.5', '10.192.27.5', '10.192.28.5', '10.192.29.5', '10.192.30.5', '10.192.31.5', '10.192.36.5', '10.192.37.5', '10.192.38.5', '10.192.39.6', '10.192.40.5', '10.192.41.5', '10.192.42.5', '10.192.43.5', '2620:0:860:101::/64', '2620:0:860:102::/64', '2620:0:860:103::/64', '2620:0:860:104::/64', '10.80.0.3', '10.80.1.8', '10.80.1.14', '10.80.0.9', '10.80.0.2', '10.80.1.10', '2a02:ec80:300:101::/64', '2a02:ec80:300:102::/64', '10.128.0.18', '10.128.0.9', '10.128.0.11', '2620:0:863:101::/64', '10.132.0.39', '10.132.0.6', '10.132.0.7', '2001:df2:e500:101::/64', '10.136.0.16', '10.136.1.19', '10.136.1.15', '10.136.0.19', '10.136.0.17', '10.136.1.20', '2a02:ec80:600:101::/64', '2a02:ec80:600:102::/64', '10.140.0.13', '10.140.1.2', '10.140.1.14', '10.140.0.2', '10.140.0.14', '10.140.1.3', '2a02:ec80:700:101::/64', '2a02:ec80:700:102::/64']
  +    ensure => present
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/cfssl/signers/wikikube]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube].orig
  +++ File[/etc/cfssl/signers/wikikube]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/sudoers.d/nrpe_certificate_check_puppet_rsa]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_puppet_rsa].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_puppet_rsa]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Systemd::Service[cfssl-ocspserve@syslog]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@syslog].orig
  +++ Systemd::Service[cfssl-ocspserve@syslog]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Timer::Job[cfssl-ocsprefresh-dse]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-dse].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-dse]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - dse
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/dse/ca/dse.pem --responses-file /etc/cfssl/ocsp/dse.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@dse' dse 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem].orig
  +++ File[/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem.orig
  +++ /etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem
  @@ -1 +0,0 @@
  -##### FAKE FOR PUPPET ######

• Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@mlserve_front_proxy]']
  -    refreshonly => True
  

• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - wikikube_staging_front_proxy
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --responses-file /etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_staging_front_proxy' wikikube_staging_front_proxy 

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-kafka-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Prometheus::Node_textfile[prometheus-check-puppet_rsa-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-puppet_rsa-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-puppet_rsa-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry --cert-path /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --outfile /var/lib/prometheus/node.d/puppet_rsa_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Systemd::Syslog[cfssl-ocsprefresh-dse]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-dse].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-dse]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Exec[Generate initial CRL for syslog]

  Parameters differences:

  --- Exec[Generate initial CRL for syslog].orig
  +++ Exec[Generate initial CRL for syslog]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/syslog/ca/syslog.pem /etc/cfssl/signers/syslog/ca/syslog-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/syslog
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/syslog
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_network_devices]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_network_devices].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_network_devices]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Profile::Pki::Multirootca::Monitoring[discovery]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[discovery].orig
  +++ Profile::Pki::Multirootca::Monitoring[discovery]
  
  -    intermediate => discovery
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/discovery/ca/discovery.pem
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-discovery-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-discovery-certificate-expiry --cert-path /etc/cfssl/signers/discovery/ca/discovery.pem --outfile /var/lib/prometheus/node.d/discovery_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_zuul]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_zuul].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_zuul]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Nrpe::Check[check_check_certificate_expiry_dse_front_proxy]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_dse_front_proxy].orig
  +++ Nrpe::Check[check_check_certificate_expiry_dse_front_proxy]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
  -    before    => Monitoring::Service[check_certificate_expiry_dse_front_proxy]
  -    ensure    => present
  -    sudo_user => root
  

• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
  

• Service[cfssl-ocspserve@cassandra]

  Parameters differences:

  --- Service[cfssl-ocspserve@cassandra].orig
  +++ Service[cfssl-ocspserve@cassandra]
  
  -    ensure => running
  -    enable => True
  

• Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-discovery-certificate-expiry --cert-path /etc/cfssl/signers/discovery/ca/discovery.pem --outfile /var/lib/prometheus/node.d/discovery_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Exec[renew certificate - OCSP_dse_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_dse_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_dse_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem -checkend 952200
  

• File[/lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (wikikube_front_proxy)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 20011 \
  -          -responses /etc/cfssl/ocsp/wikikube_front_proxy.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/logrotate.d/cfssl-gc-expired-certs]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-gc-expired-certs].orig
  +++ File[/etc/logrotate.d/cfssl-gc-expired-certs]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-gc-expired-certs.orig
  +++ /etc/logrotate.d/cfssl-gc-expired-certs
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-gc-expired-certs
  -
  -/var/log/cfssl-gc-expired-certs/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
  
  -    ensure => present
  

• File[/usr/local/bin/prometheus-check-network_devices-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-network_devices-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-network_devices-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_discovery command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "38e4dbcfd07ed60daf5bb89397abbe29" --timeout 10 --check-command "check_check_certificate_expiry_discovery"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_discovery
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-mlserve_staging.timer]']
  -    refreshonly => True
  

• Systemd::Syslog[prometheus-node-textfile-check-nft]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-check-nft].orig
  +++ Systemd::Syslog[prometheus-node-textfile-check-nft]
  
  +    readable_by            => all
  +    base_dir               => /var/log
  +    log_filename           => syslog.log
  +    ensure                 => present
  +    force_stop             => True
  +    programname_comparison => startswith
  +    owner                  => root
  +    group                  => root
  

• File[/usr/local/bin/prometheus-check-aux-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-aux-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-aux-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem']
  -    tag        => nrpe::check
  

• Cfssl::Config[mlserve_front_proxy]

  Parameters differences:

  --- Cfssl::Config[mlserve_front_proxy].orig
  +++ Cfssl::Config[mlserve_front_proxy]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/mlserve_front_proxy/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/mlserve_front_proxy
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/mlserve_front_proxy
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages      => ['signing', 'key encipherment', 'client auth']
  

• File[/etc/cfssl/ocsp/discovery.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/discovery.ocsp].orig
  +++ File[/etc/cfssl/ocsp/discovery.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]']
  

• Systemd::Syslog[ulogd]

  Parameters differences:

  --- Systemd::Syslog[ulogd].orig
  +++ Systemd::Syslog[ulogd]
  
  -    readable_by            => user
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/apache2/sites-available]

  Parameters differences:

  --- File[/etc/apache2/sites-available].orig
  +++ File[/etc/apache2/sites-available]
  
  -    require => Package[apache2]
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0755
  -    group   => root
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/signers/syslog/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/syslog/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/syslog/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/syslog/cfssl.conf.orig
  +++ /etc/cfssl/signers/syslog/cfssl.conf
  @@ -1,65 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "digital signature",
  -        "key encipherment",
  -        "server auth",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/syslog",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/syslog"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Class[Nftables]

  Parameters differences:

  --- Class[Nftables].orig
  +++ Class[Nftables]
  
  +    ensure => present
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Rsyslog::Conf[prometheus-node-textfile-check-nft]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-check-nft].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-check-nft]
  
  +    priority => 40
  +    require  => File[/var/log/prometheus-node-textfile-check-nft]
  +    ensure   => present
  +    mode     => 0444
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
  

• File[/etc/cfssl/signers/cloud_wmnet_ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/cloud_wmnet_ca].orig
  +++ File[/etc/cfssl/signers/cloud_wmnet_ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Nrpe::Monitor_service[check_certificate_expiry_dse]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_dse].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_dse]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: dse
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem
  -    timeout                     => 10
  

• Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• Nftables::Service[ssh-from-cumin-masters]

  Parameters differences:

  --- Nftables::Service[ssh-from-cumin-masters].orig
  +++ Nftables::Service[ssh-from-cumin-masters]
  
  +    ensure              => present
  +    port                => 22
  +    prio                => 10
  +    desc                => 
  +    src_sets            => ['CUMIN_MASTERS']
  +    proto               => tcp
  +    unrestricted_access => False
  +    notrack             => False
  

• File[/etc/cfssl/signers/aux/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/aux/ca].orig
  +++ File[/etc/cfssl/signers/aux/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_zuul command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_zuul
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "373325faaa689f3e9b058d91d4eb6cdb" --timeout 10 --check-command "check_check_certificate_expiry_zuul"

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-debmonitor-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-debmonitor-certificate-expiry --cert-path /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --outfile /var/lib/prometheus/node.d/debmonitor_intermediate.prom

• File[/etc/cfssl/signers/aux/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/aux/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/aux/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/aux/cfssl.conf.orig
  +++ /etc/cfssl/signers/aux/cfssl.conf
  @@ -1,81 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "signing",
  -        "key encipherment",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/aux",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/aux"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "service-account-management": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment"
  -        ]
  -      },
  -      "prometheus": {
  -        "auth_key": "default_auth",
  -        "expiry": "8760h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "client auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@wikikube]']
  -    refreshonly => True
  

• File[/etc/apache2/conf-available/50-server-status.conf]

  Parameters differences:

  --- File[/etc/apache2/conf-available/50-server-status.conf].orig
  +++ File[/etc/apache2/conf-available/50-server-status.conf]
  
  -    notify => Service[apache2]
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/httpd/status.conf
  -    mode   => 0444
  -    group  => root
  

• Cfssl::Signer[discovery2026]

  Parameters differences:

  --- Cfssl::Signer[discovery2026].orig
  +++ Cfssl::Signer[discovery2026]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDrzCCAxGgAwIBAgIUa46nWae1FhV+WZzdsRMJchzTP54wCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjYwNDIwMTUzNjAwWhcNMzEwNDE5MTUzNjAwWjB7
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMRYwFAYDVQQDEw1kaXNjb3ZlcnkyMDI2MIGbMBAGByqGSM49AgEGBSuBBAAj
  A4GGAAQBNeE+xxvbq00KO92aWhHFTLosZBkXul9ufZINtOUd90TXpQnJvpEv7kK8
  HQpufac9Dez+MBhLzQXoTY+ElhRCsQQBwlu+rIeqpbJEh87DQ2RTfzhTJmlm/9de
  1fiM38/51DacwYS/vW0psN/lKSoM7cX/Paw6Qg7pBUmUGCq2vE9wDbmjggEMMIIB
  CDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU
  SXZcMeXrgnEYbZ3z1m8j/+8XmugwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR
  0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRp
  c2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoG
  A1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9X
  aWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQgD4
  UGn506FGvacDvYS6t8JEMo6YH7jxK8dKeiZNEnhG5FSjA4Lt2BCz85sOBczxSD9h
  b9wLCxy5wOpifRePlyrZQgJBNKUXBImWpyoHmt6hNOA6X7+FmGl0tD5tLnbeuPx7
  aTlv8rfJ0d7JdsZXx+7M6YcsmxMgZCKUh4UMYu/WcczIq30=
  -----END CERTIFICATE-----
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => ##### FAKE FOR PUPPET ######
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/discovery2026
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/discovery2026
  -    ca_key_file      => /etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}
  -    default_usages   => ['digital signature', 'key encipherment', 'server auth']
  -    serve_service    => cfssl-multirootca
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_debmonitor.timer
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cassandra.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cassandra.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cassandra.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_kafka]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_kafka].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_kafka]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_kafka command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "22922fd6bc2d570e018cbe5ccd8d1727" --timeout 10 --check-command "check_check_certificate_expiry_kafka"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_kafka
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft
  @@ -0,0 +1,20 @@
  +# Autogenerated by puppet
  +set CLOUD_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2a02:ec80:a000:100::/64,
  +             2a02:ec80:a000:1::/64,
  +             2a02:ec80:a000:201::/64,
  +             2a02:ec80:a000:202::/64,
  +             2a02:ec80:a000:203::/64,
  +             2a02:ec80:a000:204::/64,
  +             2a02:ec80:a000:2ff::/64,
  +             2a02:ec80:a000:4000::/64,
  +             2a02:ec80:a100:100::/64,
  +             2a02:ec80:a100:1::/64,
  +             2a02:ec80:a100:205::/64,
  +             2a02:ec80:a100:2ff::/64,
  +             2a02:ec80:a100:4000::/64
  +    }
  +}

• Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@wikikube_staging]']
  -    refreshonly => True
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]']
  -    refreshonly => True
  

• Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• File[/etc/nftables/sets/MGMT_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/MGMT_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/MGMT_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/MGMT_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/MGMT_NETWORKS_ipv6.nft
  @@ -0,0 +1,4 @@
  +# Autogenerated by puppet
  +set MGMT_NETWORKS_ipv6 {
  +    type ipv6_addr
  +}

• Rsyslog::Conf[cfssl-ocsprefresh-zuul]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-zuul].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-zuul]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-zuul]
  -    ensure   => present
  -    mode     => 0444
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_mlserve.service
  

• Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem']
  -    tag        => nrpe::check
  

• Systemd::Service[cfssl-ocsprefresh-mlserve_front_proxy]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-mlserve_front_proxy].orig
  +++ Systemd::Service[cfssl-ocsprefresh-mlserve_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Service[cfssl-multirootca]

  Parameters differences:

  --- Service[cfssl-multirootca].orig
  +++ Service[cfssl-multirootca]
  
  -    ensure => running
  -    enable => True
  

• Nrpe::Check[check_check_certificate_expiry_dse]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_dse].orig
  +++ Nrpe::Check[check_check_certificate_expiry_dse]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem
  -    before    => Monitoring::Service[check_certificate_expiry_dse]
  -    ensure    => present
  -    sudo_user => root
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]']
  -    refreshonly => True
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer
  

• Systemd::Syslog[cfssl-ocsprefresh-discovery2026]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-discovery2026].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-discovery2026]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-wikikube_staging]
  -    ensure   => present
  -    mode     => 0444
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_network_devices]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_network_devices].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_network_devices]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_network_devices command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "21dac3775d059b8c991626e2ca33f951" --timeout 10 --check-command "check_check_certificate_expiry_network_devices"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_network_devices
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/nftables.conf]

  Parameters differences:

  --- File[/etc/nftables.conf].orig
  +++ File[/etc/nftables.conf]
  
  +    ensure => absent
  +    group  => root
  +    owner  => root
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-mlserve_staging-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_intermediate.prom

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy].orig
  +++ Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_mlserve_staging_front_proxy!10
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-aux_front_proxy
  -
  -/var/log/cfssl-ocsprefresh-aux_front_proxy/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cloud_wmnet_ca]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cloud_wmnet_ca].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cloud_wmnet_ca]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_cloud_wmnet_ca!10
  

• File_line[load_env_enabled]

  Parameters differences:

  --- File_line[load_env_enabled].orig
  +++ File_line[load_env_enabled]
  
  -    require => Package[apache2]
  -    path    => /etc/apache2/envvars
  -    match   => env-enabled
  -    line    => for f in /etc/apache2/env-enabled/*.sh; do [ -r "$f" ] && . "$f" >&2; done || true
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Monitoring::Exported_nagios_service[pki1001 raid_md]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 raid_md].orig
  +++ Monitoring::Exported_nagios_service[pki1001 raid_md]
  
  @@
  -    servicegroups         => pki_eqiad
  +    servicegroups         => insetup_eqiad
  @@
  -    notifications_enabled => 1
  +    notifications_enabled => 0
  

• Systemd::Timer[cfssl-ocsprefresh-etcd]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-etcd].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-etcd]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-etcd.service
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]']
  -    refreshonly => True
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-dse_front_proxy" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-dse_front_proxy/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Service[cfssl-ocspserve@syslog]

  Parameters differences:

  --- Service[cfssl-ocspserve@syslog].orig
  +++ Service[cfssl-ocspserve@syslog]
  
  -    ensure => running
  -    enable => True
  

• Package[iptables]

  Parameters differences:

  --- Package[iptables].orig
  +++ Package[iptables]
  
  @@
  -    ensure => installed
  +    ensure => absent
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service]

  Parameters differences:

  --- File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service].orig
  +++ File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service]
  
  -    notify => Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service.orig
  +++ /lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Auto restart job: apache-htcacheclean
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/wmf-auto-restart -s apache-htcacheclean

• Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@debmonitor]']
  -    refreshonly => True
  

• Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Sudo::User[nrpe-check_check_certificate_expiry_cloud_wmnet_ca]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_cloud_wmnet_ca].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_cloud_wmnet_ca]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem']
  -    tag        => nrpe::check
  

• Systemd::Service[cfssl-ocspserve@wikikube_staging]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@wikikube_staging].orig
  +++ Systemd::Service[cfssl-ocspserve@wikikube_staging]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/nftables/main.nft]

  Parameters differences:

  --- File[/etc/nftables/main.nft].orig
  +++ File[/etc/nftables/main.nft]
  
  +    notify  => Service[nftables]
  +    require => File[/etc/nftables]
  +    ensure  => present
  +    owner   => root
  +    source  => puppet:///modules/nftables/main.nft
  +    group   => root
  

• Service[cfssl-ocsprefresh-zuul.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-zuul.timer].orig
  +++ Service[cfssl-ocsprefresh-zuul.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Cfssl::Cert[OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => mlserve_front_proxy
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@mlserve_front_proxy]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• Cfssl::Signer[mlserve_staging_front_proxy]

  Parameters differences:

  --- Cfssl::Signer[mlserve_staging_front_proxy].orig
  +++ Cfssl::Signer[mlserve_staging_front_proxy]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
  -    default_expiry   => 72h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDvjCCAyCgAwIBAgIUV8ha2UdjViI49Xr/fZzbY4YPZdYwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
  iTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
  aW9uczEkMCIGA1UEAwwbbWxzZXJ2ZV9zdGFnaW5nX2Zyb250X3Byb3h5MIGbMBAG
  ByqGSM49AgEGBSuBBAAjA4GGAAQAyrMiWBRjOWCaMXsvXC0wS6VzHyLLGFT8BpM9
  EhYcloDfNnb8no2+YXrBzj4+lAg3D3dq53q+hyHko3+YsVVF/qABa55syWkYtxDB
  xy5FNq6Iq/s2E3vO2YpQifWXlaSZvvuZCGhhTPDOp/zdI/kKdco9Jehsu6CdyElj
  lCgJTZupZCmjggEMMIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB
  /wIBATAdBgNVHQ4EFgQUj5l8xt65hr4t5yj8xKYmUsKwk9YwHwYDVR0jBBgwFoAU
  O62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzAB
  hjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRl
  cm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292
  ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjO
  PQQDBAOBiwAwgYcCQgD24XA2cP2pFwE3onWEosbFqDEaFwD5kNg7eSOkncJIceFU
  bCX1f6VOYSv6UbiEQV0EwS0d34EawydbLcqXqfHgpgJBJJjdNhpjAcwyRt1+unRc
  dYn6ys1ZElRXMld7NUq+nCInX5cVk8uPeSev6IxIJc2eyBCb4jtjvE3TAQ2RHvT9
  sBI=
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => nosecret
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/mlserve_staging_front_proxy
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/mlserve_staging_front_proxy
  -    ca_key_file      => /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages   => ['signing', 'key encipherment', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• Sudo::User[nrpe_certificate_check_dse_front_proxy]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_dse_front_proxy].orig
  +++ Sudo::User[nrpe_certificate_check_dse_front_proxy]
  
  -    user       => nrpe_certificate_check_dse_front_proxy
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-mlserve-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-mlserve-certificate-expiry --cert-path /etc/cfssl/signers/mlserve/ca/mlserve.pem --outfile /var/lib/prometheus/node.d/mlserve_intermediate.prom

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-dse-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Cfssl::Signer[wikikube_staging]

  Parameters differences:

  --- Cfssl::Signer[wikikube_staging].orig
  +++ Cfssl::Signer[wikikube_staging]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
  -    default_expiry   => 72h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDsTCCAxSgAwIBAgIUKJGxrsUkuGnKTwrJIdYlm1ZK6uMwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB+
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMRkwFwYDVQQDDBB3aWtpa3ViZV9zdGFnaW5nMIGbMBAGByqGSM49AgEGBSuB
  BAAjA4GGAAQBJQPiRDYxLnr33KdzugCHk21yjDhyRHMrAIJ0qGmasdcMNZpK9P9u
  6ISJRfTC73WiKOSSWBuJAhsdK2Y7hIoUOikAexL5MOVOFAK8MtWXx6j7MmuuPGnC
  MIyIk1pqxzoacZWJ8uJe/WGw/Udd/RPxAfsxN8loKKT0+zs3WzGw63saO6yjggEM
  MIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4E
  FgQU8bcT1hszDpGqcobdFXNOugsbu0MwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81
  cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtp
  LmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NB
  MEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2Ny
  bC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYC
  QTKbWZ4u9V6ei9rgB4XXyyVEzIZMgVCdwuytcmqEaB9ZavqjYsdrgTOsgcy2Jw1C
  id1Sw/9g5YpcZBLaXh52CuNVAkFnnXo7+fe5kgOs2vTIsbIG4huh6ftI/8bmIdr2
  9FHm9FXlmSIDWQIn7Fq4TFLVmiatI/TdiGK+n3oT/st73jwn1A==
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => test
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/wikikube_staging
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/wikikube_staging
  -    ca_key_file      => /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages   => ['signing', 'key encipherment', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• Sudo::User[nrpe_certificate_check_discovery]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_discovery].orig
  +++ Sudo::User[nrpe_certificate_check_discovery]
  
  -    user       => nrpe_certificate_check_discovery
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• Cfssl::Signer[wikikube_staging_front_proxy]

  Parameters differences:

  --- Cfssl::Signer[wikikube_staging_front_proxy].orig
  +++ Cfssl::Signer[wikikube_staging_front_proxy]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
  -    default_expiry   => 72h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDwDCCAyGgAwIBAgIUJT4TJHFy4qcc2DDVjG00p9VDOcIwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
  ijELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
  aW9uczElMCMGA1UEAwwcd2lraWt1YmVfc3RhZ2luZ19mcm9udF9wcm94eTCBmzAQ
  BgcqhkjOPQIBBgUrgQQAIwOBhgAEAQkWDUaTmBFtrLcFLkOP5LV+kGQdr0TIYAMX
  FR7UbUmysish4+UlH7C2vcugX/XmmIoh2asGRkfb0kjTQUUjqDmmANYQARMmx/V4
  j87yMi11K3IxBh2Ei7KJzvXD5yhg/rQa1TVcdvZ1GHBL1QvBU5x2L95G+Exi1amQ
  dC4vktygtdo8o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB
  Af8CAQEwHQYDVR0OBBYEFANI4okfmz36Vpe1jEq4tkgKl5HzMB8GA1UdIwQYMBaA
  FDutonHmNL0b/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcw
  AYY6aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50
  ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2Nv
  dmVyeS53bW5ldC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZI
  zj0EAwQDgYwAMIGIAkIBuKBFQ/g6puAs+HK7+bE4eiatpN7eotPUTNbVuxN4+rEO
  E6JEpXslb/Ad0rVDvEOmXGSH9EdqjCNJs0Qv5kFnqZQCQgCPyFWGoBUxDcWLjOEL
  2a1pt4joI2BUut3NtLOBgPeaI/5qqPoLFbxn/1DMBmZLlsoNhnrg99F5LgvQVEAA
  /3y5tw==
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => test
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/wikikube_staging_front_proxy
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/wikikube_staging_front_proxy
  -    ca_key_file      => /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages   => ['signing', 'key encipherment', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Ferm::Service[multirootca_tls_termination]

  Parameters differences:

  --- Ferm::Service[multirootca_tls_termination].orig
  +++ Ferm::Service[multirootca_tls_termination]
  
  -    ensure              => present
  -    port                => 443
  -    prio                => 10
  -    desc                => 
  -    src_sets            => ['DOMAIN_NETWORKS']
  -    proto               => tcp
  -    unrestricted_access => False
  -    notrack             => False
  

• File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/etc/nftables/sets/INTERNAL_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/INTERNAL_ipv6.nft].orig
  +++ File[/etc/nftables/sets/INTERNAL_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/INTERNAL_ipv6.nft.orig
  +++ /etc/nftables/sets/INTERNAL_ipv6.nft
  @@ -0,0 +1,15 @@
  +# Autogenerated by puppet
  +set INTERNAL_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2620:0:860:100::/56,
  +             2620:0:861:100::/56,
  +             2620:0:863:100::/56,
  +             2a02:ec80:300:100::/56,
  +             2a02:ec80:600:100::/56,
  +             2a02:ec80:700:100::/56,
  +             2001:df2:e500:100::/56,
  +             2a02:ec80:ff00:100::/56
  +    }
  +}

• File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft
  @@ -0,0 +1,13 @@
  +# Autogenerated by puppet
  +set SANDBOX_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 103.102.166.72/29,
  +             185.15.59.72/29,
  +             195.200.68.64/29,
  +             198.35.26.240/28,
  +             208.80.152.240/28,
  +             208.80.155.64/28
  +    }
  +}

• File[/etc/apache2/conf-available/00-defaults.conf]

  Parameters differences:

  --- File[/etc/apache2/conf-available/00-defaults.conf].orig
  +++ File[/etc/apache2/conf-available/00-defaults.conf]
  
  -    notify => Service[apache2]
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/httpd/defaults.conf
  -    mode   => 0444
  -    group  => root
  

• Prometheus::Node_textfile[prometheus-check-zuul-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-zuul-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-zuul-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-zuul-certificate-expiry --cert-path /etc/cfssl/signers/zuul/ca/zuul.pem --outfile /var/lib/prometheus/node.d/zuul_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• File[/etc/cfssl/signers/aux_front_proxy]

  Parameters differences:

  --- File[/etc/cfssl/signers/aux_front_proxy].orig
  +++ File[/etc/cfssl/signers/aux_front_proxy]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Sudo::User[nrpe_certificate_check_network_devices]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_network_devices].orig
  +++ Sudo::User[nrpe_certificate_check_network_devices]
  
  -    user       => nrpe_certificate_check_network_devices
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_discovery command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_discovery
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "38e4dbcfd07ed60daf5bb89397abbe29" --timeout 10 --check-command "check_check_certificate_expiry_discovery"

• Systemd::Timer::Job[cfssl-ocsprefresh-wikikube]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-wikikube].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-wikikube]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - wikikube
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube/ca/wikikube.pem --responses-file /etc/cfssl/ocsp/wikikube.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube' wikikube 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Sudo::User[nrpe_certificate_check_mlserve]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_mlserve].orig
  +++ Sudo::User[nrpe_certificate_check_mlserve]
  
  -    user       => nrpe_certificate_check_mlserve
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• File[/lib/systemd/system/wmf_auto_restart_apache2.service]

  Parameters differences:

  --- File[/lib/systemd/system/wmf_auto_restart_apache2.service].orig
  +++ File[/lib/systemd/system/wmf_auto_restart_apache2.service]
  
  -    notify => Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/wmf_auto_restart_apache2.service.orig
  +++ /lib/systemd/system/wmf_auto_restart_apache2.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Auto restart job: apache2
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/wmf-auto-restart -s apache2

• Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@wikikube_staging_front_proxy]']
  -    refreshonly => True
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]']
  -    refreshonly => True
  

• Systemd::Unit[cfssl-ocsprefresh-debmonitor.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-debmonitor.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-debmonitor.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-debmonitor.timer
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-mlserve" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-mlserve/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Nftables::Service[full-monitoring-metrics-access-udp]

  Parameters differences:

  --- Nftables::Service[full-monitoring-metrics-access-udp].orig
  +++ Nftables::Service[full-monitoring-metrics-access-udp]
  
  +    ensure              => present
  +    src_ips             => ['10.64.0.82', '10.64.16.62', '10.64.32.85', '10.64.48.171', '208.80.153.42', '208.80.154.78', '2620:0:860:2:208:80:153:42', '2620:0:861:101:10:64:0:82', '2620:0:861:102:10:64:16:62', '2620:0:861:103:10:64:32:85', '2620:0:861:107:10:64:48:171', '2620:0:861:3:208:80:154:78']
  +    prio                => 10
  +    desc                => 
  +    port_range          => [1, 65535]
  +    proto               => udp
  +    unrestricted_access => False
  +    notrack             => False
  

• Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)].orig
  +++ Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Service[ulogd2]

  Parameters differences:

  --- Service[ulogd2].orig
  +++ Service[ulogd2]
  
  -    require => Package[ulogd2]
  -    ensure  => running
  -    enable  => True
  

• Monitoring::Service[check_certificate_expiry_wikikube_staging]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_wikikube_staging].orig
  +++ Monitoring::Service[check_certificate_expiry_wikikube_staging]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: wikikube_staging
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_wikikube_staging!10
  

• Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Ferm::Service[full_monitoring_metrics_access_udp]

  Parameters differences:

  --- Ferm::Service[full_monitoring_metrics_access_udp].orig
  +++ Ferm::Service[full_monitoring_metrics_access_udp]
  
  -    srange              => ['prometheus1005.eqiad.wmnet', 'prometheus1006.eqiad.wmnet', 'prometheus1007.eqiad.wmnet', 'prometheus1008.eqiad.wmnet', '208.80.154.78', '2620:0:861:3:208:80:154:78', '208.80.153.42', '2620:0:860:2:208:80:153:42']
  -    ensure              => present
  -    prio                => 10
  -    desc                => 
  -    port_range          => [1, 65535]
  -    proto               => udp
  -    unrestricted_access => False
  -    notrack             => False
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_staging command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "7cff186656c3cabbca85b5b57d0c8679" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_staging"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_mlserve_staging
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Class[Profile::Base]

  Parameters differences:

  --- Class[Profile::Base].orig
  +++ Class[Profile::Base]
  
  @@
  -    cluster => pki
  +    cluster => insetup
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-mlserve_staging
  -
  -/var/log/cfssl-ocsprefresh-mlserve_staging/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Service[cfssl-ocspserve@discovery2026]

  Parameters differences:

  --- Service[cfssl-ocspserve@discovery2026].orig
  +++ Service[cfssl-ocspserve@discovery2026]
  
  -    ensure => running
  -    enable => True
  

• File[/etc/cfssl/signers/discovery2026]

  Parameters differences:

  --- File[/etc/cfssl/signers/discovery2026].orig
  +++ File[/etc/cfssl/signers/discovery2026]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_dse.timer
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-cassandra-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-cassandra-certificate-expiry --cert-path /etc/cfssl/signers/cassandra/ca/cassandra.pem --outfile /var/lib/prometheus/node.d/cassandra_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Class[Adduser]

  Parameters differences:

  --- Class[Adduser].orig
  +++ Class[Adduser]
  
  @@
  -    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[quickstack]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[atop]', 'Package[libpython2.7]', 'Package[libpython2.7-dev]', 'Package[libpython2.7-minimal]', 'Package[python2.7]', 'Package[libpython2.7-stdlib]', 'Package[python2.7-dev]', 'Package[python2.7-minimal]', 'Package[python2.7-dbg]', 'Package[python2.7-doc]', 'Package[python2.7-examples]', 'Package[libpython2.7-testsuite]', 'Package[intel-microcode]', 'Package[rasdaemon]', 'Package[libsnmp30]', 'Package[libdns-export1104]', 'Package[libdns1104]', 'Package[libisc-export1100]', 'Package[libisc1100]', 'Package[multiarch-support]', 'Package[libjson-c3]', 'Package[libpython3.7]', 'Package[libpython3.7-minimal]', 'Package[libpython3.7-stdlib]', 'Package[python3.7]', 'Package[python3.7-minimal]', 'Package[libevent-2.1-6]', 'Package[libwireshark11]', 'Package[libwiretap8]', 'Package[libwsutil9]', 'Package[libwscodecs2]', 'Package[libperl5.28]', 'Package[libmpdec2]', 'Package[perl-modules-5.28]', 'Package[libhogweed4]', 'Package[libnettle6]', 'Package[libprocps7]', 'Package[libip6tc0]', 'Package[libip4tc0]', 'Package[libiptc0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[apache2]', 'Package[links]', 'Package[ruby-sys-filesystem]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[python3-pymysql]', 'Package[python3-cryptography]']
  +    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[quickstack]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[atop]', 'Package[libpython2.7]', 'Package[libpython2.7-dev]', 'Package[libpython2.7-minimal]', 'Package[python2.7]', 'Package[libpython2.7-stdlib]', 'Package[python2.7-dev]', 'Package[python2.7-minimal]', 'Package[python2.7-dbg]', 'Package[python2.7-doc]', 'Package[python2.7-examples]', 'Package[libpython2.7-testsuite]', 'Package[intel-microcode]', 'Package[rasdaemon]', 'Package[libsnmp30]', 'Package[libdns-export1104]', 'Package[libdns1104]', 'Package[libisc-export1100]', 'Package[libisc1100]', 'Package[multiarch-support]', 'Package[libjson-c3]', 'Package[libpython3.7]', 'Package[libpython3.7-minimal]', 'Package[libpython3.7-stdlib]', 'Package[python3.7]', 'Package[python3.7-minimal]', 'Package[libevent-2.1-6]', 'Package[libwireshark11]', 'Package[libwiretap8]', 'Package[libwsutil9]', 'Package[libwscodecs2]', 'Package[libperl5.28]', 'Package[libmpdec2]', 'Package[perl-modules-5.28]', 'Package[libhogweed4]', 'Package[libnettle6]', 'Package[libprocps7]', 'Package[libip6tc0]', 'Package[libip4tc0]', 'Package[libiptc0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[ruby-sys-filesystem]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']
  

• Systemd::Service[cfssl-ocspserve@cloud_wmnet_ca]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@cloud_wmnet_ca].orig
  +++ Systemd::Service[cfssl-ocspserve@cloud_wmnet_ca]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Service[cfssl-ocsprefresh-discovery2026]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-discovery2026].orig
  +++ Systemd::Service[cfssl-ocsprefresh-discovery2026]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-discovery2026.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_kafka]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_kafka].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_kafka]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)].orig
  +++ Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[wmf_auto_restart_apache2.timer]']
  -    refreshonly => True
  

• Package[nftables]

  Parameters differences:

  --- Package[nftables].orig
  +++ Package[nftables]
  
  +    provider => apt
  +    ensure   => present
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Exec[Generate initial CRL for mlserve]

  Parameters differences:

  --- Exec[Generate initial CRL for mlserve].orig
  +++ Exec[Generate initial CRL for mlserve]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/mlserve/ca/mlserve.pem /etc/cfssl/signers/mlserve/ca/mlserve-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/mlserve
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/mlserve
  

• Systemd::Unit[wmf_auto_restart_ulogd2.service]

  Parameters differences:

  --- Systemd::Unit[wmf_auto_restart_ulogd2.service].orig
  +++ Systemd::Unit[wmf_auto_restart_ulogd2.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => wmf_auto_restart_ulogd2.service
  

• Systemd::Unit[cfssl-ocsprefresh-discovery2026.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-discovery2026.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-discovery2026.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-discovery2026.service
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]']
  

• Cfssl::Config[mlserve]

  Parameters differences:

  --- Cfssl::Config[mlserve].orig
  +++ Cfssl::Config[mlserve]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/mlserve/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/mlserve
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/mlserve
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages      => ['signing', 'key encipherment', 'client auth']
  

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
  
  -    ensure => present
  

• Exec[apache2_test_config_and_restart]

  Parameters differences:

  --- Exec[apache2_test_config_and_restart].orig
  +++ Exec[apache2_test_config_and_restart]
  
  -    command     => /usr/sbin/service apache2 restart
  -    before      => Service[apache2]
  -    refreshonly => True
  -    onlyif      => /usr/sbin/apache2ctl configtest
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_discovery" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• Nrpe::Check[check_ferm_active]

  Parameters differences:

  --- Nrpe::Check[check_ferm_active].orig
  +++ Nrpe::Check[check_ferm_active]
  
  -    command   => /usr/local/lib/nagios/plugins/check_ferm
  -    before    => Monitoring::Service[ferm_active]
  -    ensure    => present
  -    sudo_user => root
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging_front_proxy]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging_front_proxy].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging_front_proxy]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_wikikube_staging_front_proxy!10
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_etcd.service
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_discovery.timer
  

• Prometheus::Blackbox::Check::Http[PKI_wikikube_staging]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_wikikube_staging].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_wikikube_staging]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"wikikube_staging"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Exec[Generate initial CRL for network_devices]

  Parameters differences:

  --- Exec[Generate initial CRL for network_devices].orig
  +++ Exec[Generate initial CRL for network_devices]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/network_devices/ca/network_devices.pem /etc/cfssl/signers/network_devices/ca/network_devices-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/network_devices
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/network_devices
  

• Nftables::Set[KAFKA_BROKERS_MAIN]

  Parameters differences:

  --- Nftables::Set[KAFKA_BROKERS_MAIN].orig
  +++ Nftables::Set[KAFKA_BROKERS_MAIN]
  
  +    hosts  => ['10.192.5.9', '2620:0:860:106:10:192:5:9', '10.192.22.6', '2620:0:860:112:10:192:22:6', '10.192.32.4', '2620:0:860:103:10:192:32:4', '10.192.48.33', '2620:0:860:104:10:192:48:33', '10.192.48.35', '2620:0:860:104:10:192:48:35', '10.64.0.101', '2620:0:861:101:10:64:0:101', '10.64.16.30', '2620:0:861:102:10:64:16:30', '10.64.32.45', '2620:0:861:103:10:64:32:45', '10.64.48.37', '2620:0:861:107:10:64:48:37', '10.64.152.5', '2620:0:861:120:10:64:152:5']
  +    ensure => present
  

• Class[Profile::Contacts]

  Parameters differences:

  --- Class[Profile::Contacts].orig
  +++ Class[Profile::Contacts]
  
  @@
  -    cluster => pki
  +    cluster => insetup
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-mlserve_front_proxy-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_front_proxy_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_network_devices]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem

• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_network_devices.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_network_devices.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• Cfssl::Cert[puppet_rsa__pki_discovery_wmnet]

  Parameters differences:

  --- Cfssl::Cert[puppet_rsa__pki_discovery_wmnet].orig
  +++ Cfssl::Cert[puppet_rsa__pki_discovery_wmnet]
  
  -    provide_chain   => True
  -    names           => []
  -    ensure          => present
  -    common_name     => pki.discovery.wmnet
  -    mode            => 0740
  -    before_services => []
  -    auto_renew      => True
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    group           => root
  -    hosts           => ['pki1001.eqiad.wmnet']
  -    notify_services => ['apache2']
  -    label           => puppet_rsa
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_network_devices" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• Cfssl::Cert[OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => mlserve_staging_front_proxy
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@mlserve_staging_front_proxy]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem].orig
  +++ File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem.orig
  +++ /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDsjCCAxOgAwIBAgIUHWrqd3I2VME7z6A5M3brKa5UlOgwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB9
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRgwFgYDVQQDDA9tbHNlcnZlX3N0YWdpbmcwgZswEAYHKoZIzj0CAQYFK4EE
  -ACMDgYYABAAu0g2dBBEAH2iUfZLPv+mA+1srb6S3bdVyH/kRk+QZDoOMnM0H8Edn
  -V+dakFKXnwl+w+qsOsWj1NP2FlOm3bTglwCIxFAzX5XaDfqWa74L1tIqDH6kx+bX
  -yxnuGWT/U1cv8rIHFap7ccH3h5YxPQfHy73KRTWxPln6ByswgxekotwnCKOCAQww
  -ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
  -BBSRzdapYuh57Gp5MstVlUJNJ+6zTzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
  -g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
  -ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
  -SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
  -L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
  -AY8VuLFo6MpcfxrDG8Junk8mESfQTMRbfeZM6WpHqKYBTESkpeV8HIdTYliFDAMX
  -JqE94+xbPVaTS8DZ0xiXz4SjAkIBEIIXA4nOdLYbX/MvdKWr7aDunH8n1oO3K/op
  -7NktfJd5CXuECxdSonHOb7PFW5lbpCtZrLxFzhB2Hlp1TBWHX84=
  ------END CERTIFICATE-----

• Systemd::Unit[cfssl-ocspserve@discovery2026]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@discovery2026].orig
  +++ Systemd::Unit[cfssl-ocspserve@discovery2026]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@discovery2026
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - discovery2026
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --responses-file /etc/cfssl/ocsp/discovery2026.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery2026' discovery2026 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
  

• File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Prometheus::Alert::Rule[check_check_certificate_expiry_aux_front_proxy_99cf4f8f014e8fd527800abcc213f494]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_aux_front_proxy_99cf4f8f014e8fd527800abcc213f494].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_aux_front_proxy_99cf4f8f014e8fd527800abcc213f494]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: aux_front_proxy
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="99cf4f8f014e8fd527800abcc213f494",check_name="check_check_certificate_expiry_aux_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__aux_front_proxy
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: aux_front_proxy
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_aux_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Cfssl::Config[etcd]

  Parameters differences:

  --- Cfssl::Config[etcd].orig
  +++ Cfssl::Config[etcd]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/etcd/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/etcd
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/etcd
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages      => ['digital signature', 'key encipherment', 'server auth', 'client auth']
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_cloud_wmnet_ca command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "f87f54115f2f782169eed72541c30a1e" --timeout 10 --check-command "check_check_certificate_expiry_cloud_wmnet_ca"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_discovery.service
  

• File[/etc/cfssl/signers/discovery]

  Parameters differences:

  --- File[/etc/cfssl/signers/discovery].orig
  +++ File[/etc/cfssl/signers/discovery]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer
  

• Service[cfssl-ocsprefresh-dse.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-dse.timer].orig
  +++ Service[cfssl-ocsprefresh-dse.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Systemd::Service[cfssl-ocspserve@zuul]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@zuul].orig
  +++ Systemd::Service[cfssl-ocspserve@zuul]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Service[nrpe2nodexp-check_certificate_expiry_discovery.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_discovery.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_discovery.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]']
  

• Systemd::Service[cfssl-ocspserve@wikikube_front_proxy]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@wikikube_front_proxy].orig
  +++ Systemd::Service[cfssl-ocspserve@wikikube_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
  

• Motd::Script[pki::multirootca]

  Parameters differences:

  --- Motd::Script[pki::multirootca].orig
  +++ Motd::Script[pki::multirootca]
  
  -    priority => 5
  -    ensure   => present
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem].orig
  +++ File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem.orig
  +++ /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem
  @@ -1,19 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDBjCCAmegAwIBAgIUJzV1YuedEKoaCkVVX4sGAX6x9eMwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjEwMzI1MTMyNzAwWhcNMzEwMzIzMTMyNzAwWjCB
  -nDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNh
  -biBGcmFuY2lzY28xIjAgBgNVBAoTGVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMx
  -FzAVBgNVBAsTDkNsb3VkIFNlcnZpY2VzMSMwIQYDVQQDDBpXaWtpbWVkaWFfSW50
  -ZXJuYWxfUm9vdF9DQTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAVJE6KrM3i7m
  -7uw5oZ71qWvcQv9wBoNU3nrEqPCDPRd4FS/THrd+OqmnxhJ5UIUhE31H3Ev52dNP
  -LQ+274G2MR9dACOGB4/21O1Ng5aKNAgF0NjwS50RAQmRaGs9f7kQg7coDDBqKQj0
  -GF6wG1tMI0/wdmi71d1qPX5BDYy+xGQZe1Bao0IwQDAOBgNVHQ8BAf8EBAMCAQYw
  -DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUO62iceY0vRv8gL81cYOR0O9pEzYw
  -CgYIKoZIzj0EAwQDgYwAMIGIAkIB64t/CBqDBhti8ERNX+rUh7k7zaZw0mllpfDa
  -90Gp4vUr5jNTOYi5+Was8xNHz6SCtZK6BkxjF+yb8ogG4ZknV7kCQgD6jCQHgXUx
  -mwKWMrxkrfv/yLCSytHfKCm0HSSyXKpHzKbPaIkt83JQxOoKpBmdHjPjkzVC1vjR
  -EVQD+PGFu+xryQ==
  ------END CERTIFICATE-----

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy].orig
  +++ File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/etc/cfssl/signers/mlserve/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve/ca].orig
  +++ File[/etc/cfssl/signers/mlserve/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem']
  -    tag        => nrpe::check
  

• Confd::File[/etc/ferm/conf.d/00_defs_requestctl]

  Parameters differences:

  --- Confd::File[/etc/ferm/conf.d/00_defs_requestctl].orig
  +++ Confd::File[/etc/ferm/conf.d/00_defs_requestctl]
  
  @@
  -    ensure => present
  +    ensure => absent
  

• Systemd::Unit[cfssl-ocsprefresh-wikikube.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-wikikube.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-wikikube.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-wikikube.service
  

• Prometheus::Node_textfile[prometheus-check-wikikube_staging-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-wikikube_staging-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-wikikube_staging-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• Systemd::Timer[cfssl-ocsprefresh-wikikube]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-wikikube].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-wikikube]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-wikikube.service
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_syslog]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_syslog].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_syslog]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label network_devices -profile ocsp /etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet]

  Parameters differences:

  --- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet].orig
  +++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet]
  
  -    ensure  => directory
  -    recurse => True
  -    owner   => root
  -    mode    => 0740
  -    group   => root
  

• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - wikikube_staging
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --responses-file /etc/cfssl/ocsp/wikikube_staging.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_staging' wikikube_staging 

• Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - puppet_rsa
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --responses-file /etc/cfssl/ocsp/puppet_rsa.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@puppet_rsa' puppet_rsa 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-wikikube.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-wikikube
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-wikikube
  -
  -/var/log/cfssl-ocsprefresh-wikikube/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Nrpe::Monitor_service[check_certificate_expiry_syslog]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_syslog].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_syslog]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: syslog
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem
  -    timeout                     => 10
  

• File[/etc/apache2/conf-enabled/00-defaults.conf]

  Parameters differences:

  --- File[/etc/apache2/conf-enabled/00-defaults.conf].orig
  +++ File[/etc/apache2/conf-enabled/00-defaults.conf]
  
  -    notify => Service[apache2]
  -    ensure => link
  -    target => /etc/apache2/conf-available/00-defaults.conf
  -    owner  => root
  -    group  => root
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]']
  -    refreshonly => True
  

• Systemd::Syslog[cfssl-ocsprefresh-discovery]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-discovery].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-discovery]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/sudoers.d/nrpe_certificate_check_network_devices]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_network_devices].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_network_devices]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Cfssl::Signer[wikikube_front_proxy]

  Parameters differences:

  --- Cfssl::Signer[wikikube_front_proxy].orig
  +++ Cfssl::Signer[wikikube_front_proxy]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDuDCCAxmgAwIBAgIUCqmj+2MwaOqLPb5TPXkbkF/PGkUwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
  gjELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
  aW9uczEdMBsGA1UEAwwUd2lraWt1YmVfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0C
  AQYFK4EEACMDgYYABAAUuXSlLM/Sq6jmsr6/+aqYnBNDoelW5+uJ8kWFyR/9xaFf
  hmvvui358ZLmOym6cA1tpoA1+PVZ1sVOE++GDsWQ3QDAG2kk8o0QxpXsCXLWBmJZ
  92Z/pIO7Fc65qe6XDnuZLEaqbb6VWkqQPI15cL9AhJ8HgNbaoaxrT51MfCrHEteP
  raOCAQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0G
  A1UdDgQWBBTlGjpQ7L1N14lCjcKcI/4LLNraBjAfBgNVHSMEGDAWgBQ7raJx5jS9
  G/yAvzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6
  Ly9wa2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jv
  b3RfQ0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21u
  ZXQvY3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GM
  ADCBiAJCAYT0XLJdjumemn8jpqv058zb+c+3zb+05EhNcj15wcjRUq8SU+c2+H8a
  hzfph97+CVSvGaV6Cf7phTSEBDPk9+T4AkIBdOmzIcRH+K9UcDzvdxqerOiXJaBC
  0Bgbg9dOhcd6d0j3CObOuIp760FFQLSli2ocG3WLkfNsXlL1/3+VL+yarNo=
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => test
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/wikikube_front_proxy
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/wikikube_front_proxy
  -    ca_key_file      => /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages   => ['signing', 'key encipherment', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery2026]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery2026].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery2026]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_discovery2026" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-wikikube-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-wikikube-certificate-expiry --cert-path /etc/cfssl/signers/wikikube/ca/wikikube.pem --outfile /var/lib/prometheus/node.d/wikikube_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Exec[update_alternative_iptables]

  Parameters differences:

  --- Exec[update_alternative_iptables].orig
  +++ Exec[update_alternative_iptables]
  
  -    command => /usr/bin/update-alternatives --force --set iptables /usr/sbin/iptables-legacy
  -    unless  => /usr/bin/update-alternatives --query iptables | /bin/grep 'Value: /usr/sbin/iptables-legacy'
  

• File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Service[nrpe2nodexp-check_certificate_expiry_aux.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_aux.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_aux.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]']
  

• Rsyslog::Conf[cfssl-ocsprefresh-kafka]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-kafka].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-kafka]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-kafka]
  -    ensure   => present
  -    mode     => 0444
  

• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-wikikube.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-wikikube.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-wikikube.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-wikikube.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/default/ferm]

  Parameters differences:

  --- File[/etc/default/ferm].orig
  +++ File[/etc/default/ferm]
  
  -    notify  => Service[ferm]
  -    require => Package[ferm]
  -    ensure  => file
  -    owner   => root
  -    source  => puppet:///modules/ferm/ferm.default
  -    mode    => 0400
  -    group   => root
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/signers/dse/ca/dse.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/dse/ca/dse.pem].orig
  +++ File[/etc/cfssl/signers/dse/ca/dse.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/dse/ca/dse.pem.orig
  +++ /etc/cfssl/signers/dse/ca/dse.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDpTCCAwegAwIBAgIUb4Tdc/LBMz08oj3vXm9vyvVoa8kwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjBx
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMQwwCgYDVQQDEwNkc2UwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAEKIsRi
  -rMZazQ75DhhEGhtUEr3248uYpcVNJ3Mp/1IdsIkgdy3vU97D4x+FWvbcITOzw9xz
  -apIVnwWIAU7hei4jEwCAIr3llako75gtbD7Xvq9y6UDUcp/LOGBkmGMBktL2Q9qz
  -Dgc4AgI29X2/hGBuYEglW2Qhpnbu0+q+7Xi/eKSG3aOCAQwwggEIMA4GA1UdDwEB
  -/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSp3KLmcR8APKuf
  -wQNUAmw4ugiWrzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
  -BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
  -bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
  -oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
  -bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCBhwJCAYGa4oeqY5OQzJhU
  -JqhW7Wn0V5dXQ3F0LJKbf70afe5Xx/jkMKMXv6cpUoCgq6OW5CzFHvwyYGDYc3Uy
  -Dj63k3tQAkFP3CHPBJahbaziMXpat5mFpYeRit/bScad+W+ysdXe4wLSRK3skzhU
  -pOp2n7NgGJQbM1fWuRcBPMQLEZVFsbo04A==
  ------END CERTIFICATE-----

• File[/srv/cfssl/bundles/wikikube.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/wikikube.pem].orig
  +++ File[/srv/cfssl/bundles/wikikube.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/wikikube.pem.orig
  +++ /srv/cfssl/bundles/wikikube.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDqzCCAwygAwIBAgIUWXrkQs5GEdgVcV7/XAEZOXQLYlowCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB2
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMREwDwYDVQQDEwh3aWtpa3ViZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAE
  -AX4fMTh3NrBZlCMop5eKr6F/RXTefrSSdu6DE39OOKTTdYM3TxK8tPmTDm9EE+XT
  -4rO+VHuaIVVirgB2JQtla8oZAZb60Pw8v9BlJ1JLLK9vpWA9Vce7DKmMNxIWK9GA
  -YIUQufjHVD2eibYJsK54NGkBe3frhPhwayIvzJ3gGO34GRaRo4IBDDCCAQgwDgYD
  -VR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFAaU1Sae
  -B9+FDd+SrIADU8yIo+xJMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2
  -MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zl
  -cnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8E
  -QzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1l
  -ZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBFZVjRbh3
  -GaouRaz9IPef3q+9s+TleKGby7nJQ6z71M3rpJIsHr9lncr/9GPq5v5cHDYOHmgK
  -GBupTY7FNMwL8aACQgCgoDP6PO23Dw6tuswLIbeY+o5l3K8R5L3RS1DO59OXXV2f
  -9FmoJNLgGXgP87rOkFW1fn9/QcvX85zD0urkq8gNjg==
  ------END CERTIFICATE-----

• Rsyslog::Conf[wmf_auto_restart_ulogd2]

  Parameters differences:

  --- Rsyslog::Conf[wmf_auto_restart_ulogd2].orig
  +++ Rsyslog::Conf[wmf_auto_restart_ulogd2]
  
  -    priority => 40
  -    require  => File[/var/log/wmf_auto_restart_ulogd2]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/ferm/conf.d/10_ssh_from_cumin_masters]

  Parameters differences:

  --- File[/etc/ferm/conf.d/10_ssh_from_cumin_masters].orig
  +++ File[/etc/ferm/conf.d/10_ssh_from_cumin_masters]
  
  -    notify  => Service[ferm]
  -    require => File[/etc/ferm/conf.d]
  -    ensure  => present
  -    owner   => root
  -    tag     => ferm
  -    mode    => 0400
  -    group   => root
  

  Content differences:

  --- /etc/ferm/conf.d/10_ssh_from_cumin_masters.orig
  +++ /etc/ferm/conf.d/10_ssh_from_cumin_masters
  @@ -1,6 +0,0 @@
  -# Autogenerated by puppet. DO NOT EDIT BY HAND!
  -#
  -# 
  -&R_SERVICE(tcp, 22, $CUMIN_MASTERS);
  -
  -

• Systemd::Timer[cfssl-ocsprefresh-puppet_rsa]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-puppet_rsa].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-puppet_rsa]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-puppet_rsa.service
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_zuul" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• File[/etc/cfssl/ocsp/syslog.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/syslog.ocsp].orig
  +++ File[/etc/cfssl/ocsp/syslog.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-cassandra" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-cassandra/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/lib/systemd/system/cfssl-ocsprefresh-dse.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-dse.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-dse.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-dse.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-dse.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-dse.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-dse.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Nrpe::Check[check_check_certificate_expiry_wikikube_staging_front_proxy]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_wikikube_staging_front_proxy].orig
  +++ Nrpe::Check[check_check_certificate_expiry_wikikube_staging_front_proxy]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
  -    before    => Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy]
  -    ensure    => present
  -    sudo_user => root
  

• File[/etc/ferm/conf.d/98_filter_log_filter-bootp]

  Parameters differences:

  --- File[/etc/ferm/conf.d/98_filter_log_filter-bootp].orig
  +++ File[/etc/ferm/conf.d/98_filter_log_filter-bootp]
  
  -    notify  => Service[ferm]
  -    require => File[/etc/ferm/conf.d]
  -    ensure  => present
  -    owner   => root
  -    tag     => ferm
  -    mode    => 0400
  -    group   => root
  

  Content differences:

  --- /etc/ferm/conf.d/98_filter_log_filter-bootp.orig
  +++ /etc/ferm/conf.d/98_filter_log_filter-bootp
  @@ -1,11 +0,0 @@
  -# Autogenerated by puppet. DO NOT EDIT BY HAND!
  -#
  -# 98_filter_log_filter-bootp: 
  -
  -domain (ip ip6) {
  -	table filter {
  -		chain INPUT {
  -			proto udp  daddr 255.255.255.255 sport 67 dport 68 DROP;
  -		}
  -	}
  -}

• Profile::Pki::Multirootca::Monitoring[mlserve_staging]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[mlserve_staging].orig
  +++ Profile::Pki::Multirootca::Monitoring[mlserve_staging]
  
  -    intermediate => mlserve_staging
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
  

• File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_cloud_wmnet_ca command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "f87f54115f2f782169eed72541c30a1e" --timeout 10 --check-command "check_check_certificate_expiry_cloud_wmnet_ca"

• Profile::Pki::Multirootca::Monitoring[kafka]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[kafka].orig
  +++ Profile::Pki::Multirootca::Monitoring[kafka]
  
  -    intermediate => kafka
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/kafka/ca/kafka.pem
  

• File[/etc/ferm/conf.d/99_dscp-default]

  Parameters differences:

  --- File[/etc/ferm/conf.d/99_dscp-default].orig
  +++ File[/etc/ferm/conf.d/99_dscp-default]
  
  -    notify  => Service[ferm]
  -    require => File[/etc/ferm/conf.d]
  -    ensure  => present
  -    owner   => root
  -    tag     => ferm
  -    mode    => 0400
  -    group   => root
  

  Content differences:

  --- /etc/ferm/conf.d/99_dscp-default.orig
  +++ /etc/ferm/conf.d/99_dscp-default
  @@ -1,11 +0,0 @@
  -# Autogenerated by puppet. DO NOT EDIT BY HAND!
  -#
  -# 99_dscp-default: 
  -
  -domain (ip ip6) {
  -	table mangle {
  -		chain POSTROUTING {
  -			DSCP set-dscp-class CS0;
  -		}
  -	}
  -}

• Systemd::Service[cfssl-ocspserve@network_devices]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@network_devices].orig
  +++ Systemd::Service[cfssl-ocspserve@network_devices]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Httpd::Mod_conf[proxy_http]

  Parameters differences:

  --- Httpd::Mod_conf[proxy_http].orig
  +++ Httpd::Mod_conf[proxy_http]
  
  -    mod      => proxy_http
  -    ensure   => present
  -    loadfile => proxy_http.load
  

• Exec[ensure_present_mod_headers]

  Parameters differences:

  --- Exec[ensure_present_mod_headers].orig
  +++ Exec[ensure_present_mod_headers]
  
  -    command => /usr/sbin/a2enmod headers
  -    notify  => Service[apache2]
  -    require => Package[apache2]
  -    creates => /etc/apache2/mods-enabled/headers.load
  

• Nftables::Set[LABSTORE_HOSTS]

  Parameters differences:

  --- Nftables::Set[LABSTORE_HOSTS].orig
  +++ Nftables::Set[LABSTORE_HOSTS]
  
  +    hosts  => ['208.80.154.142', '2620:0:861:2:208:80:154:142', '208.80.154.71', '2620:0:861:3:208:80:154:71']
  +    ensure => present
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-zuul-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-zuul-certificate-expiry --cert-path /etc/cfssl/signers/zuul/ca/zuul.pem --outfile /var/lib/prometheus/node.d/zuul_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_front_proxy command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "9d6dd05c8e5e1bb294462d932b24bd1a" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_front_proxy"

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse_front_proxy].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Rsyslog::Conf[cfssl-ocsprefresh-etcd]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-etcd].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-etcd]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-etcd]
  -    ensure   => present
  -    mode     => 0444
  

• Nftables::Set[CUMIN_MASTERS]

  Parameters differences:

  --- Nftables::Set[CUMIN_MASTERS].orig
  +++ Nftables::Set[CUMIN_MASTERS]
  
  +    hosts  => ['10.64.16.154', '2620:0:861:102:10:64:16:154', '10.192.32.49', '2620:0:860:103:10:192:32:49']
  +    ensure => present
  

• File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft.orig
  +++ /etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft
  @@ -0,0 +1,42 @@
  +# Autogenerated by puppet
  +set LOAD_BALANCER_HEALTH_CHECKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2620:0:861:101::/64,
  +             2620:0:861:102::/64,
  +             2620:0:861:103::/64,
  +             2620:0:861:107::/64,
  +             2620:0:861:109::/64,
  +             2620:0:861:10a::/64,
  +             2620:0:861:10b::/64,
  +             2620:0:861:10d::/64,
  +             2620:0:861:10e::/64,
  +             2620:0:861:10f::/64,
  +             2620:0:861:119::/64,
  +             2620:0:861:10c::/64,
  +             2620:0:861:113::/64,
  +             2620:0:861:131::/64,
  +             2620:0:861:133::/64,
  +             2620:0:861:135::/64,
  +             2620:0:861:137::/64,
  +             2620:0:861:139::/64,
  +             2620:0:861:13b::/64,
  +             2620:0:861:13d::/64,
  +             2620:0:861:13f::/64,
  +             2620:0:861:142::/64,
  +             2620:0:861:144::/64,
  +             2620:0:860:101::/64,
  +             2620:0:860:102::/64,
  +             2620:0:860:103::/64,
  +             2620:0:860:104::/64,
  +             2a02:ec80:300:101::/64,
  +             2a02:ec80:300:102::/64,
  +             2620:0:863:101::/64,
  +             2001:df2:e500:101::/64,
  +             2a02:ec80:600:101::/64,
  +             2a02:ec80:600:102::/64,
  +             2a02:ec80:700:101::/64,
  +             2a02:ec80:700:102::/64
  +    }
  +}

• File[/etc/cfssl/signers/cassandra/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/cassandra/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/cassandra/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/cassandra/cfssl.conf.orig
  +++ /etc/cfssl/signers/cassandra/cfssl.conf
  @@ -1,65 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "digital signature",
  -        "key encipherment",
  -        "server auth",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/cassandra",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/cassandra"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Systemd::Timer[cfssl-ocsprefresh-wikikube_staging]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-wikikube_staging].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-wikikube_staging]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-wikikube_staging.service
  

• File[/srv/cfssl/bundles/network_devices.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/network_devices.pem].orig
  +++ File[/srv/cfssl/bundles/network_devices.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/network_devices.pem.orig
  +++ /srv/cfssl/bundles/network_devices.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDsjCCAxOgAwIBAgIUS2pUBD1erPOX2W9m08l4NjcjbVYwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNzE0MTAxODAwWhcNMjgwNzEyMTAxODAwWjB9
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRgwFgYDVQQDDA9uZXR3b3JrX2RldmljZXMwgZswEAYHKoZIzj0CAQYFK4EE
  -ACMDgYYABABVWARjDjpjG7IlggP4BkOm5hanZXdtYYzUb1CsmHvpBA4W6s8CjzHp
  -QlZoBzaMi6SSO5Q7v9rAuymjLctweVRy7gAkNU3jjQXZPjRKaW/ofZlUhDyhgyCS
  -WNr9LBjYklAnMM3yz3J6EG9aHehHbV11lq24AQDrZ4bEtNzGHMQyU9ufZ6OCAQww
  -ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
  -BBRmY7aPPiOyhsjgXpDtumx9X/wcGzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
  -g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
  -ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
  -SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
  -L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
  -ARWhtt4Mi0I8j+6LUC+ZJfTnhYkEWSXa6nhttbzNPLzHuBTnj42WE8a2oQW2Mv5w
  -mzRdtJGsstcrgGwGt5FyLP6WAkIAxYlEt4MHqohD9adWY1IsnX4qWBYRw4tXrx0T
  -tF1M2n2K7ww/zCL9HkBoWVe249y+ctpGqqgw0ROMnMN6Q2Zg8ic=
  ------END CERTIFICATE-----

• Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• File[/srv/cfssl/bundles/dse.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/dse.pem].orig
  +++ File[/srv/cfssl/bundles/dse.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/dse.pem.orig
  +++ /srv/cfssl/bundles/dse.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDpTCCAwegAwIBAgIUb4Tdc/LBMz08oj3vXm9vyvVoa8kwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjBx
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMQwwCgYDVQQDEwNkc2UwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAEKIsRi
  -rMZazQ75DhhEGhtUEr3248uYpcVNJ3Mp/1IdsIkgdy3vU97D4x+FWvbcITOzw9xz
  -apIVnwWIAU7hei4jEwCAIr3llako75gtbD7Xvq9y6UDUcp/LOGBkmGMBktL2Q9qz
  -Dgc4AgI29X2/hGBuYEglW2Qhpnbu0+q+7Xi/eKSG3aOCAQwwggEIMA4GA1UdDwEB
  -/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSp3KLmcR8APKuf
  -wQNUAmw4ugiWrzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
  -BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
  -bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
  -oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
  -bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCBhwJCAYGa4oeqY5OQzJhU
  -JqhW7Wn0V5dXQ3F0LJKbf70afe5Xx/jkMKMXv6cpUoCgq6OW5CzFHvwyYGDYc3Uy
  -Dj63k3tQAkFP3CHPBJahbaziMXpat5mFpYeRit/bScad+W+ysdXe4wLSRK3skzhU
  -pOp2n7NgGJQbM1fWuRcBPMQLEZVFsbo04A==
  ------END CERTIFICATE-----

• File[/var/log/cfssl-ocsprefresh-network_devices]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-network_devices].orig
  +++ File[/var/log/cfssl-ocsprefresh-network_devices]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem]
  
  -    notify    => Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
  -    show_diff => False
  -    owner     => root
  -    before    => Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem.orig
  +++ /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem
  @@ -1 +0,0 @@
  -FAKE FAKE FAKE

• Nrpe::Monitor_service[check_certificate_expiry_debmonitor]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_debmonitor].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_debmonitor]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: debmonitor
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
  -    timeout                     => 10
  

• Prometheus::Node_textfile[prometheus-check-mlserve-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-mlserve-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-mlserve-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-mlserve-certificate-expiry --cert-path /etc/cfssl/signers/mlserve/ca/mlserve.pem --outfile /var/lib/prometheus/node.d/mlserve_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• File[/lib/systemd/system/cfssl-ocspserve@syslog.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@syslog.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@syslog.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@syslog.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@syslog.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (syslog)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 10007 \
  -          -responses /etc/cfssl/ocsp/syslog.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Unit[cfssl-ocspserve@dse_front_proxy]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@dse_front_proxy].orig
  +++ Systemd::Unit[cfssl-ocspserve@dse_front_proxy]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@dse_front_proxy
  

• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_debmonitor command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_debmonitor
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "224e2ac3574a9ce482218106d95a2931" --timeout 10 --check-command "check_check_certificate_expiry_debmonitor"

• File[/lib/systemd/system/cfssl-ocspserve@dse.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@dse.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@dse.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@dse.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@dse.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (dse)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 20061 \
  -          -responses /etc/cfssl/ocsp/dse.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Exec[Generate initial CRL for mlserve_front_proxy]

  Parameters differences:

  --- Exec[Generate initial CRL for mlserve_front_proxy].orig
  +++ Exec[Generate initial CRL for mlserve_front_proxy]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/mlserve_front_proxy
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/mlserve_front_proxy
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy]
  -    ensure   => present
  -    mode     => 0444
  

• Service[cfssl-ocsprefresh-mlserve.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-mlserve.timer].orig
  +++ Service[cfssl-ocsprefresh-mlserve.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/lib/systemd/system/wmf_auto_restart_ulogd2.timer]

  Parameters differences:

  --- File[/lib/systemd/system/wmf_auto_restart_ulogd2.timer].orig
  +++ File[/lib/systemd/system/wmf_auto_restart_ulogd2.timer]
  
  -    notify => Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.timer (wmf_auto_restart_ulogd2.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/wmf_auto_restart_ulogd2.timer.orig
  +++ /lib/systemd/system/wmf_auto_restart_ulogd2.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of wmf_auto_restart_ulogd2.service
  -
  -[Timer]
  -Unit=wmf_auto_restart_ulogd2.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 5:37:00
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
  

• Monitoring::Service[check_certificate_expiry_discovery]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_discovery].orig
  +++ Monitoring::Service[check_certificate_expiry_discovery]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: discovery
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_discovery!10
  

• Nftables::Set[MGMT_NETWORKS]

  Parameters differences:

  --- Nftables::Set[MGMT_NETWORKS].orig
  +++ Nftables::Set[MGMT_NETWORKS]
  
  +    hosts  => ['10.65.0.0/16', '10.128.128.0/17', '10.193.0.0/16', '10.80.128.0/17', '10.132.128.0/17', '10.136.128.0/17', '10.140.128.0/17']
  +    ensure => present
  

• File[/usr/local/sbin/ferm-status]

  Parameters differences:

  --- File[/usr/local/sbin/ferm-status].orig
  +++ File[/usr/local/sbin/ferm-status]
  
  @@
  -    ensure => file
  +    ensure => absent
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-wikikube_staging_front_proxy-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_front_proxy_intermediate.prom

• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-mlserve_staging_front_proxy" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Rsyslog::Conf[cfssl-ocsprefresh-puppet_rsa]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-puppet_rsa].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-puppet_rsa]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-puppet_rsa]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-wikikube_staging
  -
  -/var/log/cfssl-ocsprefresh-wikikube_staging/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_cassandra.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_cassandra.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer]']
  -    refreshonly => True
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
  
  -    ensure => present
  

• Systemd::Service[cfssl-ocspserve@aux]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@aux].orig
  +++ Systemd::Service[cfssl-ocspserve@aux]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-wikikube_staging_front_proxy-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_front_proxy_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Timer::Job[cfssl-ocsprefresh-discovery]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-discovery].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-discovery]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - discovery
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery/ca/discovery.pem --responses-file /etc/cfssl/ocsp/discovery.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery' discovery 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-mlserve_front_proxy.service
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]']
  -    refreshonly => True
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• Cfssl::Ocsp[cloud_wmnet_ca]

  Parameters differences:

  --- Cfssl::Ocsp[cloud_wmnet_ca].orig
  +++ Cfssl::Ocsp[cloud_wmnet_ca]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 10004
  -    db_driver          => mysql
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Logrotate::Conf[cfssl-ocsprefresh-mlserve_front_proxy]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-mlserve_front_proxy].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-mlserve_front_proxy]
  
  -    ensure => present
  

• Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: mlserve_staging
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
  -    timeout                     => 10
  

• Cfssl::Ocsp[wikikube_staging_front_proxy]

  Parameters differences:

  --- Cfssl::Ocsp[wikikube_staging_front_proxy].orig
  +++ Cfssl::Ocsp[wikikube_staging_front_proxy]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 20021
  -    db_driver          => mysql
  

• Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - mlserve_front_proxy
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --responses-file /etc/cfssl/ocsp/mlserve_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_front_proxy' mlserve_front_proxy 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Httpd::Conf[cfssl-issuer-k8s-pods-vhost-port]

  Parameters differences:

  --- Httpd::Conf[cfssl-issuer-k8s-pods-vhost-port].orig
  +++ Httpd::Conf[cfssl-issuer-k8s-pods-vhost-port]
  
  -    priority  => 50
  -    conf_type => conf
  -    ensure    => present
  

• Systemd::Syslog[cfssl-ocsprefresh-aux]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-aux].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-aux]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/cfssl/db.conf]

  Parameters differences:

  --- File[/etc/cfssl/db.conf].orig
  +++ File[/etc/cfssl/db.conf]
  
  -    notify    => Service[cfssl-multirootca]
  -    require   => ['Package[golang-cfssl]']
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/db.conf.orig
  +++ /etc/cfssl/db.conf
  @@ -1 +0,0 @@
  -{"driver":"mysql","data_source":"pki:changeme@tcp(m1-master.eqiad.wmnet:3306)/pki?parseTime=true&tls=skip-verify"}

• File[/etc/cfssl/signers/mlserve_staging]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_staging].orig
  +++ File[/etc/cfssl/signers/mlserve_staging]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_staging command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "f389c556cebfcfc345b3d6802f320045" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_staging"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_wikikube_staging
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_zuul.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_zuul.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_zuul.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Systemd::Syslog[cfssl-ocsprefresh-puppet_rsa]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-puppet_rsa].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-puppet_rsa]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Nrpe::Monitor_service[check_certificate_expiry_kafka]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_kafka].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_kafka]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: kafka
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem
  -    timeout                     => 10
  

• File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-kafka]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-kafka].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-kafka]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-kafka.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-kafka
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-kafka
  -
  -/var/log/cfssl-ocsprefresh-kafka/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Rsyslog::Conf[cfssl-ocsprefresh-dse]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-dse].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-dse]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-dse]
  -    ensure   => present
  -    mode     => 0444
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-discovery2026.timer]']
  -    refreshonly => True
  

• Firewall::Service[multirootca tls termination]

  Parameters differences:

  --- Firewall::Service[multirootca tls termination].orig
  +++ Firewall::Service[multirootca tls termination]
  
  -    ensure              => present
  -    port                => 443
  -    prio                => 10
  -    desc                => 
  -    src_sets            => ['DOMAIN_NETWORKS']
  -    proto               => tcp
  -    unrestricted_access => False
  -    notrack             => False
  

• Systemd::Unit[cfssl-ocspserve@kafka]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@kafka].orig
  +++ Systemd::Unit[cfssl-ocspserve@kafka]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@kafka
  

• Systemd::Syslog[cfssl-ocsprefresh-wikikube]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-wikikube].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-wikikube]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@puppet_rsa]']
  -    refreshonly => True
  

• File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft
  @@ -0,0 +1,183 @@
  +# Autogenerated by puppet
  +set PRODUCTION_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2001:df2:e500:101::/64,
  +             2001:df2:e500:103::/64,
  +             2001:df2:e500:1::/64,
  +             2001:df2:e500:3::/64,
  +             2001:df2:e500:ed1a::/64,
  +             2620:0:860:100::/64,
  +             2620:0:860:101::/64,
  +             2620:0:860:102::/64,
  +             2620:0:860:103::/64,
  +             2620:0:860:104::/64,
  +             2620:0:860:105::/64,
  +             2620:0:860:106::/64,
  +             2620:0:860:107::/64,
  +             2620:0:860:108::/64,
  +             2620:0:860:109::/64,
  +             2620:0:860:10a::/64,
  +             2620:0:860:10b::/64,
  +             2620:0:860:10c::/64,
  +             2620:0:860:10d::/64,
  +             2620:0:860:10e::/64,
  +             2620:0:860:10f::/64,
  +             2620:0:860:110::/64,
  +             2620:0:860:111::/64,
  +             2620:0:860:112::/64,
  +             2620:0:860:113::/64,
  +             2620:0:860:114::/64,
  +             2620:0:860:115::/64,
  +             2620:0:860:116::/64,
  +             2620:0:860:118::/64,
  +             2620:0:860:119::/64,
  +             2620:0:860:11a::/64,
  +             2620:0:860:11b::/64,
  +             2620:0:860:11c::/64,
  +             2620:0:860:11d::/64,
  +             2620:0:860:11e::/64,
  +             2620:0:860:11f::/64,
  +             2620:0:860:120::/64,
  +             2620:0:860:121::/64,
  +             2620:0:860:122::/64,
  +             2620:0:860:123::/64,
  +             2620:0:860:124::/64,
  +             2620:0:860:125::/64,
  +             2620:0:860:126::/64,
  +             2620:0:860:127::/64,
  +             2620:0:860:12b::/64,
  +             2620:0:860:12c::/64,
  +             2620:0:860:12d::/64,
  +             2620:0:860:12e::/64,
  +             2620:0:860:140::/64,
  +             2620:0:860:1::/64,
  +             2620:0:860:2::/64,
  +             2620:0:860:300::/64,
  +             2620:0:860:301::/64,
  +             2620:0:860:302::/64,
  +             2620:0:860:303::/64,
  +             2620:0:860:304::/64,
  +             2620:0:860:305::/64,
  +             2620:0:860:307::/64,
  +             2620:0:860:308::/64,
  +             2620:0:860:3::/64,
  +             2620:0:860:4::/64,
  +             2620:0:860:5::/64,
  +             2620:0:860:babe::/64,
  +             2620:0:860:babf::/64,
  +             2620:0:860:cabe::/64,
  +             2620:0:860:cabf::/64,
  +             2620:0:860:ed1a::/64,
  +             2620:0:861:100::/64,
  +             2620:0:861:101::/64,
  +             2620:0:861:102::/64,
  +             2620:0:861:103::/64,
  +             2620:0:861:104::/64,
  +             2620:0:861:105::/64,
  +             2620:0:861:106::/64,
  +             2620:0:861:107::/64,
  +             2620:0:861:108::/64,
  +             2620:0:861:109::/64,
  +             2620:0:861:10a::/64,
  +             2620:0:861:10b::/64,
  +             2620:0:861:10c::/64,
  +             2620:0:861:10d::/64,
  +             2620:0:861:10e::/64,
  +             2620:0:861:10f::/64,
  +             2620:0:861:110::/64,
  +             2620:0:861:111::/64,
  +             2620:0:861:112::/64,
  +             2620:0:861:113::/64,
  +             2620:0:861:114::/64,
  +             2620:0:861:115::/64,
  +             2620:0:861:116::/64,
  +             2620:0:861:117::/64,
  +             2620:0:861:118::/64,
  +             2620:0:861:119::/64,
  +             2620:0:861:11a::/64,
  +             2620:0:861:11c::/64,
  +             2620:0:861:11d::/64,
  +             2620:0:861:11e::/64,
  +             2620:0:861:11f::/64,
  +             2620:0:861:120::/64,
  +             2620:0:861:121::/64,
  +             2620:0:861:122::/64,
  +             2620:0:861:123::/64,
  +             2620:0:861:124::/64,
  +             2620:0:861:125::/64,
  +             2620:0:861:126::/64,
  +             2620:0:861:127::/64,
  +             2620:0:861:128::/64,
  +             2620:0:861:129::/64,
  +             2620:0:861:12a::/64,
  +             2620:0:861:12b::/64,
  +             2620:0:861:12c::/64,
  +             2620:0:861:12d::/64,
  +             2620:0:861:12e::/64,
  +             2620:0:861:12f::/64,
  +             2620:0:861:131::/64,
  +             2620:0:861:132::/64,
  +             2620:0:861:133::/64,
  +             2620:0:861:134::/64,
  +             2620:0:861:135::/64,
  +             2620:0:861:136::/64,
  +             2620:0:861:137::/64,
  +             2620:0:861:138::/64,
  +             2620:0:861:139::/64,
  +             2620:0:861:13a::/64,
  +             2620:0:861:13b::/64,
  +             2620:0:861:13c::/64,
  +             2620:0:861:13d::/64,
  +             2620:0:861:13e::/64,
  +             2620:0:861:13f::/64,
  +             2620:0:861:140::/64,
  +             2620:0:861:141::/64,
  +             2620:0:861:142::/64,
  +             2620:0:861:143::/64,
  +             2620:0:861:144::/64,
  +             2620:0:861:145::/64,
  +             2620:0:861:1::/64,
  +             2620:0:861:2::/64,
  +             2620:0:861:300::/64,
  +             2620:0:861:301::/116,
  +             2620:0:861:302::/64,
  +             2620:0:861:303::/116,
  +             2620:0:861:304::/116,
  +             2620:0:861:305::/64,
  +             2620:0:861:3::/64,
  +             2620:0:861:4::/64,
  +             2620:0:861:babe::/64,
  +             2620:0:861:babf::/116,
  +             2620:0:861:cabe::/64,
  +             2620:0:861:cabf::/116,
  +             2620:0:861:ed1a::/64,
  +             2620:0:863:101::/64,
  +             2620:0:863:102::/64,
  +             2620:0:863:103::/64,
  +             2620:0:863:1::/64,
  +             2620:0:863:2::/64,
  +             2620:0:863:3::/64,
  +             2620:0:863:ed1a::/64,
  +             2a02:ec80:300:101::/64,
  +             2a02:ec80:300:102::/64,
  +             2a02:ec80:300:103::/64,
  +             2a02:ec80:300:1::/64,
  +             2a02:ec80:300:2::/64,
  +             2a02:ec80:300:3::/64,
  +             2a02:ec80:300:ed1a::/64,
  +             2a02:ec80:600:101::/64,
  +             2a02:ec80:600:102::/64,
  +             2a02:ec80:600:1::/64,
  +             2a02:ec80:600:2::/64,
  +             2a02:ec80:600:ed1a::/64,
  +             2a02:ec80:700:101::/64,
  +             2a02:ec80:700:102::/64,
  +             2a02:ec80:700:103::/64,
  +             2a02:ec80:700:1::/64,
  +             2a02:ec80:700:2::/64,
  +             2a02:ec80:700:3::/64,
  +             2a02:ec80:700:ed1a::/64
  +    }
  +}

• Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@aux_front_proxy]']
  -    refreshonly => True
  

• Exec[renew certificate - OCSP_network_devices_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_network_devices_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_network_devices_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label network_devices -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging -profile ocsp /etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Systemd::Timer::Job[cfssl-ocsprefresh-mlserve]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-mlserve].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-mlserve]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - mlserve
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve/ca/mlserve.pem --responses-file /etc/cfssl/ocsp/mlserve.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve' mlserve 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Class[Cfssl::Multirootca]

  Parameters differences:

  --- Class[Cfssl::Multirootca].orig
  +++ Class[Cfssl::Multirootca]
  
  -    ensure              => present
  -    enable_monitoring   => True
  -    signers             => {'debmonitor': {'private': '/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem', 'certificate': '/etc/cfssl/signers/debmonitor/ca/debmonitor.pem', 'config': '/etc/cfssl/signers/debmonitor/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'discovery': {'private': '/etc/cfssl/signers/discovery/ca/discovery-key.pem', 'certificate': '/etc/cfssl/signers/discovery/ca/discovery.pem', 'config': '/etc/cfssl/signers/discovery/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'kafka': {'private': '/etc/cfssl/signers/kafka/ca/kafka-key.pem', 'certificate': '/etc/cfssl/signers/kafka/ca/kafka.pem', 'config': '/etc/cfssl/signers/kafka/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'cloud_wmnet_ca': {'private': '/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem', 'certificate': '/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem', 'config': '/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'etcd': {'private': '/etc/cfssl/signers/etcd/ca/etcd-key.pem', 'certificate': '/etc/cfssl/signers/etcd/ca/etcd.pem', 'config': '/etc/cfssl/signers/etcd/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'cassandra': {'private': '/etc/cfssl/signers/cassandra/ca/cassandra-key.pem', 'certificate': '/etc/cfssl/signers/cassandra/ca/cassandra.pem', 'config': '/etc/cfssl/signers/cassandra/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'syslog': {'private': '/etc/cfssl/signers/syslog/ca/syslog-key.pem', 'certificate': '/etc/cfssl/signers/syslog/ca/syslog.pem', 'config': '/etc/cfssl/signers/syslog/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'puppet_rsa': {'private': '/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem', 'certificate': '/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem', 'config': '/etc/cfssl/signers/puppet_rsa/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'zuul': {'private': '/etc/cfssl/signers/zuul/ca/zuul-key.pem', 'certificate': '/etc/cfssl/signers/zuul/ca/zuul.pem', 'config': '/etc/cfssl/signers/zuul/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'discovery2026': {'private': '/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem', 'certificate': '/etc/cfssl/signers/discovery2026/ca/discovery2026.pem', 'config': '/etc/cfssl/signers/discovery2026/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'wikikube': {'private': '/etc/cfssl/signers/wikikube/ca/wikikube-key.pem', 'certificate': '/etc/cfssl/signers/wikikube/ca/wikikube.pem', 'config': '/etc/cfssl/signers/wikikube/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'wikikube_front_proxy': {'private': '/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem', 'config': '/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'wikikube_staging': {'private': '/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem', 'certificate': '/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem', 'config': '/etc/cfssl/signers/wikikube_staging/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'wikikube_staging_front_proxy': {'private': '/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem', 'config': '/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'mlserve': {'private': '/etc/cfssl/signers/mlserve/ca/mlserve-key.pem', 'certificate': '/etc/cfssl/signers/mlserve/ca/mlserve.pem', 'config': '/etc/cfssl/signers/mlserve/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'mlserve_front_proxy': {'private': '/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem', 'config': '/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'mlserve_staging': {'private': '/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem', 'certificate': '/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem', 'config': '/etc/cfssl/signers/mlserve_staging/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'mlserve_staging_front_proxy': {'private': '/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem', 'config': '/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'aux': {'private': '/etc/cfssl/signers/aux/ca/aux-key.pem', 'certificate': '/etc/cfssl/signers/aux/ca/aux.pem', 'config': '/etc/cfssl/signers/aux/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'aux_front_proxy': {'private': '/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem', 'config': '/etc/cfssl/signers/aux_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'dse': {'private': '/etc/cfssl/signers/dse/ca/dse-key.pem', 'certificate': '/etc/cfssl/signers/dse/ca/dse.pem', 'config': '/etc/cfssl/signers/dse/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'dse_front_proxy': {'private': '/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem', 'config': '/etc/cfssl/signers/dse_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'network_devices': {'private': '/etc/cfssl/signers/network_devices/ca/network_devices-key.pem', 'certificate': '/etc/cfssl/signers/network_devices/ca/network_devices.pem', 'config': '/etc/cfssl/signers/network_devices/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}}
  -    port                => 8888
  -    monitoring_critical => True
  -    host                => 127.0.0.1
  

• File[/etc/sudoers.d/nrpe_certificate_check_mlserve_front_proxy]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_mlserve_front_proxy].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_mlserve_front_proxy]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Systemd::Service[cfssl-ocsprefresh-discovery]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-discovery].orig
  +++ Systemd::Service[cfssl-ocsprefresh-discovery]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-discovery.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
  

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
  
  -    ensure => present
  

• File[/etc/cfssl/signers/kafka]

  Parameters differences:

  --- File[/etc/cfssl/signers/kafka].orig
  +++ File[/etc/cfssl/signers/kafka]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Logrotate::Conf[cfssl-ocsprefresh-debmonitor]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-debmonitor].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-debmonitor]
  
  -    ensure => present
  

• Prometheus::Blackbox::Check::Http[PKI_mlserve]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_mlserve].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_mlserve]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"mlserve"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Cfssl::Signer[dse]

  Parameters differences:

  --- Cfssl::Signer[dse].orig
  +++ Cfssl::Signer[dse]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/dse/ca/dse.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDpTCCAwegAwIBAgIUb4Tdc/LBMz08oj3vXm9vyvVoa8kwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjBx
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMQwwCgYDVQQDEwNkc2UwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAEKIsRi
  rMZazQ75DhhEGhtUEr3248uYpcVNJ3Mp/1IdsIkgdy3vU97D4x+FWvbcITOzw9xz
  apIVnwWIAU7hei4jEwCAIr3llako75gtbD7Xvq9y6UDUcp/LOGBkmGMBktL2Q9qz
  Dgc4AgI29X2/hGBuYEglW2Qhpnbu0+q+7Xi/eKSG3aOCAQwwggEIMA4GA1UdDwEB
  /wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSp3KLmcR8APKuf
  wQNUAmw4ugiWrzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
  BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
  bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
  oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
  bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCBhwJCAYGa4oeqY5OQzJhU
  JqhW7Wn0V5dXQ3F0LJKbf70afe5Xx/jkMKMXv6cpUoCgq6OW5CzFHvwyYGDYc3Uy
  Dj63k3tQAkFP3CHPBJahbaziMXpat5mFpYeRit/bScad+W+ysdXe4wLSRK3skzhU
  pOp2n7NgGJQbM1fWuRcBPMQLEZVFsbo04A==
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => 
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/dse
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/dse
  -    ca_key_file      => /etc/cfssl/signers/dse/ca/dse-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages   => ['signing', 'key encipherment', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• Nftables::Set[MONITORING_HOSTS]

  Parameters differences:

  --- Nftables::Set[MONITORING_HOSTS].orig
  +++ Nftables::Set[MONITORING_HOSTS]
  
  +    hosts  => ['208.80.154.78', '2620:0:861:3:208:80:154:78', '208.80.153.42', '2620:0:860:2:208:80:153:42']
  +    ensure => present
  

• Cfssl::Signer[aux_front_proxy]

  Parameters differences:

  --- Cfssl::Signer[aux_front_proxy].orig
  +++ Cfssl::Signer[aux_front_proxy]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDsjCCAxOgAwIBAgIUcL3aZt8/kOKuFw8g90SCOk9VZSYwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjB9
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMRgwFgYDVQQDDA9hdXhfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
  ACMDgYYABAFQamNeMXOM8jZDTMiL/0Cgk641Tps3tMBQ6f1OD7fqLh7JGWZXSWIE
  9v25H6dgcqSIWAlvBkbHQUPU51GmXigXtwCW1bYWFZc+MTjXFo2LBUJVUIxh2mh3
  pNZYlgVZXP7a0l3zt2u5vegKRuJ6l0ELtjCJjo/TNYo/BA28XrzCL45HO6OCAQww
  ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
  BBQv7ovDzaQTat1sfWJFkZ+n8+aGSTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
  g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
  ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
  SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
  L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
  AZ7oTip5kp2Yt9BABNEqYi6GjwpXZvmZOgd6So8UA76jP8duYicuOoNvpoHdEy58
  ZOGpo0lqqIzB8xQcvzvmX7uiAkIAxHVKylOLCoPsUXaZVfUGhNavXXwrbIHTQXDo
  HEHmc9lIMh9hO5z4vPMEbMkSRuAskcT1K/ydEqp4xI191jnovUg=
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => nosecret
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/aux_front_proxy
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/aux_front_proxy
  -    ca_key_file      => /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages   => ['signing', 'key encipherment', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• File[/srv/cfssl/crl]

  Parameters differences:

  --- File[/srv/cfssl/crl].orig
  +++ File[/srv/cfssl/crl]
  
  -    ensure => directory
  -    group  => root
  -    owner  => root
  

• Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging -profile ocsp /etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• File[/etc/ferm/conf.d/02_main]

  Parameters differences:

  --- File[/etc/ferm/conf.d/02_main].orig
  +++ File[/etc/ferm/conf.d/02_main]
  
  -    notify  => Service[ferm]
  -    ensure  => present
  -    tag     => ferm
  -    mode    => 0400
  -    require => File[/etc/ferm/conf.d]
  -    owner   => root
  -    source  => puppet:///modules/base/firewall/main-input-default-drop.conf
  -    group   => root
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-network_devices]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-network_devices].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-network_devices]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-network_devices.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-network_devices
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-network_devices
  -
  -/var/log/cfssl-ocsprefresh-network_devices/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_debmonitor]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_debmonitor].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_debmonitor]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_debmonitor command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "224e2ac3574a9ce482218106d95a2931" --timeout 10 --check-command "check_check_certificate_expiry_debmonitor"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_debmonitor
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-puppet_rsa-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry --cert-path /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --outfile /var/lib/prometheus/node.d/puppet_rsa_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging_front_proxy]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging_front_proxy].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging_front_proxy]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
  -    timeout                     => 10
  

• File[/etc/cfssl/signers/mlserve_staging/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_staging/ca].orig
  +++ File[/etc/cfssl/signers/mlserve_staging/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Nrpe::Monitor_service[check_certificate_expiry_mlserve_front_proxy]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_mlserve_front_proxy].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_mlserve_front_proxy]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: mlserve_front_proxy
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
  -    timeout                     => 10
  

• File[/srv/cfssl/bundles/wikikube_staging.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/wikikube_staging.pem].orig
  +++ File[/srv/cfssl/bundles/wikikube_staging.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/wikikube_staging.pem.orig
  +++ /srv/cfssl/bundles/wikikube_staging.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDsTCCAxSgAwIBAgIUKJGxrsUkuGnKTwrJIdYlm1ZK6uMwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB+
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRkwFwYDVQQDDBB3aWtpa3ViZV9zdGFnaW5nMIGbMBAGByqGSM49AgEGBSuB
  -BAAjA4GGAAQBJQPiRDYxLnr33KdzugCHk21yjDhyRHMrAIJ0qGmasdcMNZpK9P9u
  -6ISJRfTC73WiKOSSWBuJAhsdK2Y7hIoUOikAexL5MOVOFAK8MtWXx6j7MmuuPGnC
  -MIyIk1pqxzoacZWJ8uJe/WGw/Udd/RPxAfsxN8loKKT0+zs3WzGw63saO6yjggEM
  -MIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4E
  -FgQU8bcT1hszDpGqcobdFXNOugsbu0MwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81
  -cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtp
  -LmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NB
  -MEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2Ny
  -bC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYC
  -QTKbWZ4u9V6ei9rgB4XXyyVEzIZMgVCdwuytcmqEaB9ZavqjYsdrgTOsgcy2Jw1C
  -id1Sw/9g5YpcZBLaXh52CuNVAkFnnXo7+fe5kgOs2vTIsbIG4huh6ftI/8bmIdr2
  -9FHm9FXlmSIDWQIn7Fq4TFLVmiatI/TdiGK+n3oT/st73jwn1A==
  ------END CERTIFICATE-----

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_aux_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem

• Exec[Generate initial CRL for discovery2026]

  Parameters differences:

  --- Exec[Generate initial CRL for discovery2026].orig
  +++ Exec[Generate initial CRL for discovery2026]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/discovery2026/ca/discovery2026.pem /etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/discovery2026
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/discovery2026
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
  

• File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca].orig
  +++ File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Nftables::Set[SANDBOX_NETWORKS]

  Parameters differences:

  --- Nftables::Set[SANDBOX_NETWORKS].orig
  +++ Nftables::Set[SANDBOX_NETWORKS]
  
  +    hosts  => ['103.102.166.72/29', '185.15.59.72/29', '195.200.68.64/29', '198.35.26.240/28', '2001:df2:e500:202::/64', '208.80.152.240/28', '208.80.155.64/28', '2620:0:860:201::/64', '2620:0:861:202::/64', '2620:0:863:201::/64', '2a02:ec80:300:202::/64', '2a02:ec80:700:201::/64']
  +    ensure => present
  

• Profile::Pki::Multirootca::Monitoring[mlserve_staging_front_proxy]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[mlserve_staging_front_proxy].orig
  +++ Profile::Pki::Multirootca::Monitoring[mlserve_staging_front_proxy]
  
  -    intermediate => mlserve_staging_front_proxy
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
  

• Systemd::Syslog[cfssl-ocsprefresh-aux_front_proxy]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-aux_front_proxy].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-aux_front_proxy]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]
  
  -    ensure => present
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem

• Exec[renew certificate - puppet_rsa__pki_discovery_wmnet]

  Parameters differences:

  --- Exec[renew certificate - puppet_rsa__pki_discovery_wmnet].orig
  +++ Exec[renew certificate - puppet_rsa__pki_discovery_wmnet]
  
  -    notify      => ['Service[apache2]']
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa  /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet
  
  -    require     => Exec[Generate cert puppet_rsa__pki_discovery_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem -checkend 952200
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Timer[cfssl-gc-expired-certs]

  Parameters differences:

  --- Systemd::Timer[cfssl-gc-expired-certs].orig
  +++ Systemd::Timer[cfssl-gc-expired-certs]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': 'hourly'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-gc-expired-certs.service
  

• File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft.orig
  +++ /etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft
  @@ -0,0 +1,11 @@
  +# Autogenerated by puppet
  +set ZOOKEEPER_FLINK_HOSTS_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:102:10:64:16:9,
  +             2620:0:861:101:10:64:0:8,
  +             2620:0:861:103:10:64:32:41,
  +             2620:0:860:102:10:192:16:227,
  +             2620:0:860:103:10:192:32:179,
  +             2620:0:860:104:10:192:48:219
  +    }
  +}

• File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-discovery2026.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-discovery2026.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label kafka -profile ocsp /etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Nrpe::Monitor_service[check_certificate_expiry_wikikube]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_wikikube].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_wikikube]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: wikikube
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem
  -    timeout                     => 10
  

• Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change].orig
  +++ Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change]
  
  -    notify      => ['Service[apache2]']
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa  /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet
  
  -    refreshonly => True
  -    require     => Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    subscribe   => File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]
  

• Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label debmonitor -profile ocsp /etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• File[/etc/cfssl/signers/discovery/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/discovery/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/discovery/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/discovery/cfssl.conf.orig
  +++ /etc/cfssl/signers/discovery/cfssl.conf
  @@ -1,129 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "digital signature",
  -        "key encipherment",
  -        "server auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/discovery",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/discovery"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "k8s_staging": {
  -        "auth_key": "k8s_staging",
  -        "expiry": "24h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "k8s_wikikube": {
  -        "auth_key": "k8s_wikikube",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "k8s_mlserve": {
  -        "auth_key": "k8s_mlserve",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "k8s_mlstaging": {
  -        "auth_key": "k8s_mlstaging",
  -        "expiry": "24h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "k8s_dse": {
  -        "auth_key": "k8s_dse",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth",
  -          "client auth"
  -        ]
  -      },
  -      "k8s_dse_opensearch": {
  -        "auth_key": "k8s_dse",
  -        "expiry": "4380h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth",
  -          "client auth"
  -        ]
  -      },
  -      "k8s_aux": {
  -        "auth_key": "k8s_aux",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_dse" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• Profile::Pki::Multirootca::Monitoring[syslog]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[syslog].orig
  +++ Profile::Pki::Multirootca::Monitoring[syslog]
  
  -    intermediate => syslog
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/syslog/ca/syslog.pem
  

• Service[nrpe2nodexp-ferm_active.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-ferm_active.timer].orig
  +++ Service[nrpe2nodexp-ferm_active.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-cloud_wmnet_ca.timer
  

• Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Cfssl::Config[wikikube_staging]

  Parameters differences:

  --- Cfssl::Config[wikikube_staging].orig
  +++ Cfssl::Config[wikikube_staging]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/wikikube_staging/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 72h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/wikikube_staging
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/wikikube_staging
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages      => ['signing', 'key encipherment', 'client auth']
  

• Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service]

  Parameters differences:

  --- Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service].orig
  +++ Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => wmf_auto_restart_apache-htcacheclean.service
  

• Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer
  

• Service[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_debmonitor.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]']
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Service[cfssl-ocspserve@discovery2026]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@discovery2026].orig
  +++ Systemd::Service[cfssl-ocspserve@discovery2026]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Service[wmf_auto_restart_apache2.timer]

  Parameters differences:

  --- Service[wmf_auto_restart_apache2.timer].orig
  +++ Service[wmf_auto_restart_apache2.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Service[apache-htcacheclean]

  Parameters differences:

  --- Service[apache-htcacheclean].orig
  +++ Service[apache-htcacheclean]
  
  -    ensure => stopped
  -    enable => False
  

• File[/etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf]

  Parameters differences:

  --- File[/etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf].orig
  +++ File[/etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf]
  
  -    notify => Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf.orig
  +++ /etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf
  @@ -1,3 +0,0 @@
  -[Unit]
  -After=network-online.target
  -Wants=network-online.target

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_dse command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_dse
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "4384c5ebc49e03dbe331e279fac3f393" --timeout 10 --check-command "check_check_certificate_expiry_dse"

• File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• File[/etc/apache2/conf-available]

  Parameters differences:

  --- File[/etc/apache2/conf-available].orig
  +++ File[/etc/apache2/conf-available]
  
  -    require => Package[apache2]
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0755
  -    group   => root
  

• File[/etc/cfssl/signers/network_devices/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/network_devices/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/network_devices/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/network_devices/cfssl.conf.orig
  +++ /etc/cfssl/signers/network_devices/cfssl.conf
  @@ -1,64 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "digital signature",
  -        "key encipherment",
  -        "server auth"
  -      ],
  -      "expiry": "8760h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/network_devices",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/network_devices"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem].orig
  +++ Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]
  
  -    notify    => ['Service[apache2]']
  -    command   => /bin/cat /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem > /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem
  -    require   => Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change]
  -    unless    => /usr/bin/test "$(/bin/cat /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem | sha512sum)" == "$(/bin/cat /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem | sha512sum)"
  
  -    subscribe => ['Exec[renew certificate - puppet_rsa__pki_discovery_wmnet]', 'File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]', 'File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem]']
  

• Nrpe::Monitor_service[check_certificate_expiry_puppet_rsa]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_puppet_rsa].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_puppet_rsa]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: puppet_rsa
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
  -    timeout                     => 10
  

• Nftables::Set[KAFKAMON_HOSTS]

  Parameters differences:

  --- Nftables::Set[KAFKAMON_HOSTS].orig
  +++ Nftables::Set[KAFKAMON_HOSTS]
  
  +    hosts  => ['10.64.32.11', '2620:0:861:103:10:64:32:11', '10.192.16.139', '2620:0:860:102:10:192:16:139']
  +    ensure => present
  

• File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• File[/usr/local/bin/prometheus-check-zuul-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-zuul-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-zuul-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca].orig
  +++ File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging_front_proxy.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging_front_proxy.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging_front_proxy.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_aux command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "f7dfe9e2cd77303dfae7ae11c5c56d90" --timeout 10 --check-command "check_check_certificate_expiry_aux"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_aux
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_network_devices]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_network_devices].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_network_devices]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_network_devices.service
  

• File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Prometheus::Node_textfile[prometheus-check-aux-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-aux-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-aux-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-aux-certificate-expiry --cert-path /etc/cfssl/signers/aux/ca/aux.pem --outfile /var/lib/prometheus/node.d/aux_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• File[/etc/logrotate.d/wmf_auto_restart_ulogd2]

  Parameters differences:

  --- File[/etc/logrotate.d/wmf_auto_restart_ulogd2].orig
  +++ File[/etc/logrotate.d/wmf_auto_restart_ulogd2]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/wmf_auto_restart_ulogd2.orig
  +++ /etc/logrotate.d/wmf_auto_restart_ulogd2
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for wmf_auto_restart_ulogd2
  -
  -/var/log/wmf_auto_restart_ulogd2/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Logrotate::Conf[wmf_auto_restart_apache2]

  Parameters differences:

  --- Logrotate::Conf[wmf_auto_restart_apache2].orig
  +++ Logrotate::Conf[wmf_auto_restart_apache2]
  
  -    ensure => present
  

• File[/etc/cfssl/signers/zuul]

  Parameters differences:

  --- File[/etc/cfssl/signers/zuul].orig
  +++ File[/etc/cfssl/signers/zuul]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• File[/etc/nftables/sets/MONITORING_HOSTS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/MONITORING_HOSTS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/MONITORING_HOSTS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/MONITORING_HOSTS_ipv6.nft.orig
  +++ /etc/nftables/sets/MONITORING_HOSTS_ipv6.nft
  @@ -0,0 +1,7 @@
  +# Autogenerated by puppet
  +set MONITORING_HOSTS_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:3:208:80:154:78,
  +             2620:0:860:2:208:80:153:42
  +    }
  +}

• Sudo::User[nrpe-check_check_certificate_expiry_discovery]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_discovery].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_discovery]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem']
  -    tag        => nrpe::check
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse_front_proxy].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_dse_front_proxy command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "2560f4f577ba169af651cf96bd5dc1ba" --timeout 10 --check-command "check_check_certificate_expiry_dse_front_proxy"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_dse_front_proxy
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/cfssl/signers/wikikube_staging/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_staging/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/wikikube_staging/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/wikikube_staging/cfssl.conf.orig
  +++ /etc/cfssl/signers/wikikube_staging/cfssl.conf
  @@ -1,81 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "signing",
  -        "key encipherment",
  -        "client auth"
  -      ],
  -      "expiry": "72h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/wikikube_staging",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/wikikube_staging"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "72h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "service-account-management": {
  -        "auth_key": "default_auth",
  -        "expiry": "72h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment"
  -        ]
  -      },
  -      "prometheus": {
  -        "auth_key": "default_auth",
  -        "expiry": "8760h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "client auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging]
  
  -    ensure => present
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-discovery2026]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-discovery2026].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-discovery2026]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-discovery2026.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-discovery2026
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-discovery2026
  -
  -/var/log/cfssl-ocsprefresh-discovery2026/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft].orig
  +++ File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft.orig
  +++ /etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft
  @@ -0,0 +1,15 @@
  +# Autogenerated by puppet
  +set KAFKA_BROKERS_MAIN_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:860:106:10:192:5:9,
  +             2620:0:860:112:10:192:22:6,
  +             2620:0:860:103:10:192:32:4,
  +             2620:0:860:104:10:192:48:33,
  +             2620:0:860:104:10:192:48:35,
  +             2620:0:861:101:10:64:0:101,
  +             2620:0:861:102:10:64:16:30,
  +             2620:0:861:103:10:64:32:45,
  +             2620:0:861:107:10:64:48:37,
  +             2620:0:861:120:10:64:152:5
  +    }
  +}

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• Cfssl::Ocsp[mlserve]

  Parameters differences:

  --- Cfssl::Ocsp[mlserve].orig
  +++ Cfssl::Ocsp[mlserve]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/mlserve/ca/mlserve.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 20030
  -    db_driver          => mysql
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-network_devices" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-network_devices/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Rsyslog::Conf[wmf_auto_restart_apache2]

  Parameters differences:

  --- Rsyslog::Conf[wmf_auto_restart_apache2].orig
  +++ Rsyslog::Conf[wmf_auto_restart_apache2]
  
  -    priority => 40
  -    require  => File[/var/log/wmf_auto_restart_apache2]
  -    ensure   => present
  -    mode     => 0444
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_wikikube.service
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux_front_proxy].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Service[nrpe2nodexp-check_certificate_expiry_cassandra.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_cassandra.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_cassandra.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]']
  

• Profile::Pki::Multirootca::Monitoring[etcd]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[etcd].orig
  +++ Profile::Pki::Multirootca::Monitoring[etcd]
  
  -    intermediate => etcd
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/etcd/ca/etcd.pem
  

• Systemd::Unit[cfssl-ocsprefresh-wikikube.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-wikikube.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-wikikube.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-wikikube.timer
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-cloud_wmnet_ca" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-cloud_wmnet_ca/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_cloud_wmnet_ca]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_zuul.timer
  

• File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft
  @@ -0,0 +1,38 @@
  +# Autogenerated by puppet
  +set ANALYTICS_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2620:0:861:100::/64,
  +             2620:0:861:104::/64,
  +             2620:0:861:105::/64,
  +             2620:0:861:106::/64,
  +             2620:0:861:108::/64,
  +             2620:0:861:110::/64,
  +             2620:0:861:111::/64,
  +             2620:0:861:112::/64,
  +             2620:0:861:114::/64,
  +             2620:0:861:115::/64,
  +             2620:0:861:116::/64,
  +             2620:0:861:117::/64,
  +             2620:0:861:11a::/64,
  +             2620:0:861:121::/64,
  +             2620:0:861:123::/64,
  +             2620:0:861:125::/64,
  +             2620:0:861:127::/64,
  +             2620:0:861:129::/64,
  +             2620:0:861:12b::/64,
  +             2620:0:861:12d::/64,
  +             2620:0:861:12f::/64,
  +             2620:0:861:132::/64,
  +             2620:0:861:134::/64,
  +             2620:0:861:136::/64,
  +             2620:0:861:138::/64,
  +             2620:0:861:13a::/64,
  +             2620:0:861:13c::/64,
  +             2620:0:861:13e::/64,
  +             2620:0:861:141::/64,
  +             2620:0:861:143::/64,
  +             2620:0:861:145::/64
  +    }
  +}

• Service[cfssl-ocsprefresh-network_devices.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-network_devices.timer].orig
  +++ Service[cfssl-ocsprefresh-network_devices.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - mlserve_staging
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --responses-file /etc/cfssl/ocsp/mlserve_staging.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_staging' mlserve_staging 

• File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/var/log/cfssl-ocsprefresh-syslog]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-syslog].orig
  +++ File[/var/log/cfssl-ocsprefresh-syslog]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@dse]']
  -    refreshonly => True
  

• File[/etc/apache2/env-enabled]

  Parameters differences:

  --- File[/etc/apache2/env-enabled].orig
  +++ File[/etc/apache2/env-enabled]
  
  -    notify  => Service[apache2]
  -    ensure  => directory
  -    recurse => True
  -    purge   => True
  -    mode    => 0755
  -    require => Package[apache2]
  -    owner   => root
  -    group   => root
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]']
  -    refreshonly => True
  

• Nftables::Set[ANALYTICS_NETWORKS]

  Parameters differences:

  --- Nftables::Set[ANALYTICS_NETWORKS].orig
  +++ Nftables::Set[ANALYTICS_NETWORKS]
  
  +    hosts  => ['10.64.137.0/24', '10.64.138.0/24', '10.64.139.0/24', '10.64.140.0/24', '10.64.142.0/24', '10.64.143.0/24', '10.64.144.0/24', '10.64.145.0/24', '10.64.153.0/24', '10.64.155.0/24', '10.64.157.0/24', '10.64.159.0/24', '10.64.161.0/24', '10.64.163.0/24', '10.64.165.0/24', '10.64.167.0/24', '10.64.170.0/24', '10.64.172.0/24', '10.64.174.0/24', '10.64.176.0/24', '10.64.178.0/24', '10.64.180.0/24', '10.64.182.0/24', '10.64.184.0/24', '10.64.186.0/24', '10.64.188.0/24', '10.64.190.0/24', '10.64.21.0/24', '10.64.36.0/24', '10.64.5.0/24', '10.64.53.0/24', '2620:0:861:100::/64', '2620:0:861:104::/64', '2620:0:861:105::/64', '2620:0:861:106::/64', '2620:0:861:108::/64', '2620:0:861:110::/64', '2620:0:861:111::/64', '2620:0:861:112::/64', '2620:0:861:114::/64', '2620:0:861:115::/64', '2620:0:861:116::/64', '2620:0:861:117::/64', '2620:0:861:11a::/64', '2620:0:861:121::/64', '2620:0:861:123::/64', '2620:0:861:125::/64', '2620:0:861:127::/64', '2620:0:861:129::/64', '2620:0:861:12b::/64', '2620:0:861:12d::/64', '2620:0:861:12f::/64', '2620:0:861:132::/64', '2620:0:861:134::/64', '2620:0:861:136::/64', '2620:0:861:138::/64', '2620:0:861:13a::/64', '2620:0:861:13c::/64', '2620:0:861:13e::/64', '2620:0:861:141::/64', '2620:0:861:143::/64', '2620:0:861:145::/64']
  +    ensure => present
  

• File[/srv/cfssl/bundles/puppet_rsa.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/puppet_rsa.pem].orig
  +++ File[/srv/cfssl/bundles/puppet_rsa.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/puppet_rsa.pem.orig
  +++ /srv/cfssl/bundles/puppet_rsa.pem
  @@ -1,30 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIFNDCCBJagAwIBAgIUOR+ZAFtrzLKYphDIGMa9eF6O0LIwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjIwMTIwNTAwWhcNMjgwNjE4MTIwNTAwWjB4
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRMwEQYDVQQDDApwdXBwZXRfcnNhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
  -MIICCgKCAgEA4urK5Og7RVGoXg6KzYywzaXyRROuj0Kauc7n/BgCWvsKv9Ll4f/p
  -lbVGOSln3akzhBlJwmVTGrgCmWQVxMF2agKAR+R1aV2Wc+yEfofUbW1oRgBCelMQ
  -Xutw0cApO+lzjHNtduffeIEVBjwLcEG/OdaUa2CGFGLG/dHox7o8AZgkH7SFJyby
  -z/rzip+szHpMThhjs0PKx91VS1srb7Q1jE1OlB7ydhX+gLRWTjwxOp1ITFXjNobk
  -i16jcP3YYgCvj8qwWMcYmtI7iExSeFdptv3fmajBeoi1o52LUWKUrslwtNa/emaB
  -FBGRZfu8ap+BWWpYYarI4mOCyvetw/6FZ2LnuWy5cNA3GoALB5xfLpO3twYnrveP
  -BnxULp4Q8szITB/bjPBMkd8FG8Frpe3eZNKNHG9xjJGdS1Bxhq7Zgfy09V1RJCym
  -AJSWERHRrxjEnRCDd7HUAhfaDCygeooe4wGRR5bG8WqOpkQDtYPP3yfk5NBhcJpW
  -mXTRFTFkuslEL/2bwa9EPIOAKAINDeJOCHqJMQd6EXwTP2LabWU3oI+sfeBdCoSd
  -Rn+q2Z0kSLu8fqXsgPgvdgyWjfPkQnyLAz9rdsal2x4x9SilDkov+l6Q9DXGGoYO
  -GGOHHFCFhM9CS02zFGLe1JbqiHPuYuIkEnGjGJyCqdIB8Rz0JxdypEcCAwEAAaOC
  -AQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1Ud
  -DgQWBBRrq/ZHBKl8OZGQrQCiUq4GRc86YDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yA
  -vzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9w
  -a2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3Rf
  -Q0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQv
  -Y3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCB
  -hwJBJHrjuBvyK8Sv40xCW/TrVtOCIVaXfjwsKau9lkmt/6purO/xkppZDMajueYw
  -9koKhj6SvliOpiwgypfOKP7nbsACQgFAnawARDYCoOQ8pQDoqpRkPBBScMOTMPFu
  -xTekxW2V7POn9dn6uavLJz/wha+sNgAnYT4wHWkRJzbUk+1H3Hb3NA==
  ------END CERTIFICATE-----

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_mlserve.service
  

• File[/etc/cfssl/signers/mlserve_front_proxy]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_front_proxy].orig
  +++ File[/etc/cfssl/signers/mlserve_front_proxy]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• File_line[auto_restart_file_presence_ulogd2]

  Parameters differences:

  --- File_line[auto_restart_file_presence_ulogd2].orig
  +++ File_line[auto_restart_file_presence_ulogd2]
  
  -    require => File[/etc/debdeploy-client/autorestarts.conf]
  -    path    => /etc/debdeploy-client/autorestarts.conf
  -    ensure  => present
  -    line    => ulogd2
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cloud_wmnet_ca -profile ocsp /etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-kafka-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-kafka-certificate-expiry --cert-path /etc/cfssl/signers/kafka/ca/kafka.pem --outfile /var/lib/prometheus/node.d/kafka_intermediate.prom

• Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label zuul -profile ocsp /etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• File[/etc/cfssl/ocsp/mlserve.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/mlserve.ocsp].orig
  +++ File[/etc/cfssl/ocsp/mlserve.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging -profile ocsp /etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• Monitoring::Service[check_certificate_expiry_dse_front_proxy]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_dse_front_proxy].orig
  +++ Monitoring::Service[check_certificate_expiry_dse_front_proxy]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: dse_front_proxy
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_dse_front_proxy!10
  

• Profile::Pki::Multirootca::Monitoring[cassandra]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[cassandra].orig
  +++ Profile::Pki::Multirootca::Monitoring[cassandra]
  
  -    intermediate => cassandra
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/cassandra/ca/cassandra.pem
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_cfssl-multirootca_status]=/usr/local/lib/nagios/plugins/check_systemd_unit_status cfssl-multirootca

• Service[prometheus-node-textfile-check-nft.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-check-nft.timer].orig
  +++ Service[prometheus-node-textfile-check-nft.timer]
  
  +    provider => systemd
  +    ensure   => running
  +    enable   => True
  

• Systemd::Syslog[cfssl-ocsprefresh-wikikube_front_proxy]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-wikikube_front_proxy].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-wikikube_front_proxy]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/etc/cfssl/signers/mlserve/ca/mlserve-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve/ca/mlserve-key.pem].orig
  +++ File[/etc/cfssl/signers/mlserve/ca/mlserve-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/mlserve/ca/mlserve-key.pem.orig
  +++ /etc/cfssl/signers/mlserve/ca/mlserve-key.pem
  @@ -1 +0,0 @@
  -nosecret

• File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
  

• File[/etc/cfssl/signers/network_devices/ca/network_devices.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/network_devices/ca/network_devices.pem].orig
  +++ File[/etc/cfssl/signers/network_devices/ca/network_devices.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/network_devices/ca/network_devices.pem.orig
  +++ /etc/cfssl/signers/network_devices/ca/network_devices.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDsjCCAxOgAwIBAgIUS2pUBD1erPOX2W9m08l4NjcjbVYwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNzE0MTAxODAwWhcNMjgwNzEyMTAxODAwWjB9
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRgwFgYDVQQDDA9uZXR3b3JrX2RldmljZXMwgZswEAYHKoZIzj0CAQYFK4EE
  -ACMDgYYABABVWARjDjpjG7IlggP4BkOm5hanZXdtYYzUb1CsmHvpBA4W6s8CjzHp
  -QlZoBzaMi6SSO5Q7v9rAuymjLctweVRy7gAkNU3jjQXZPjRKaW/ofZlUhDyhgyCS
  -WNr9LBjYklAnMM3yz3J6EG9aHehHbV11lq24AQDrZ4bEtNzGHMQyU9ufZ6OCAQww
  -ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
  -BBRmY7aPPiOyhsjgXpDtumx9X/wcGzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
  -g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
  -ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
  -SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
  -L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
  -ARWhtt4Mi0I8j+6LUC+ZJfTnhYkEWSXa6nhttbzNPLzHuBTnj42WE8a2oQW2Mv5w
  -mzRdtJGsstcrgGwGt5FyLP6WAkIAxYlEt4MHqohD9adWY1IsnX4qWBYRw4tXrx0T
  -tF1M2n2K7ww/zCL9HkBoWVe249y+ctpGqqgw0ROMnMN6Q2Zg8ic=
  ------END CERTIFICATE-----

• Prometheus::Blackbox::Check::Http[PKI_cloud_wmnet_ca]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_cloud_wmnet_ca].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_cloud_wmnet_ca]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"cloud_wmnet_ca"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Httpd::Conf[defaults]

  Parameters differences:

  --- Httpd::Conf[defaults].orig
  +++ Httpd::Conf[defaults]
  
  -    priority  => 0
  -    source    => puppet:///modules/httpd/defaults.conf
  -    ensure    => present
  -    conf_type => conf
  

• File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Service[cfssl-ocsprefresh-syslog.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-syslog.timer].orig
  +++ Service[cfssl-ocsprefresh-syslog.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - wikikube_staging_front_proxy
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --responses-file /etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_staging_front_proxy' wikikube_staging_front_proxy 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• File[/etc/systemd/system/nftables.service.d/puppet-override.conf]

  Parameters differences:

  --- File[/etc/systemd/system/nftables.service.d/puppet-override.conf].orig
  +++ File[/etc/systemd/system/nftables.service.d/puppet-override.conf]
  
  +    notify => Exec[systemd daemon-reload for nftables.service (nftables)]
  +    ensure => present
  +    owner  => root
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/systemd/system/nftables.service.d/puppet-override.conf.orig
  +++ /etc/systemd/system/nftables.service.d/puppet-override.conf
  @@ -0,0 +1,5 @@
  +[Service]
  +ExecStart=
  +ExecStart=/usr/sbin/nft -f /etc/nftables/main.nft
  +ExecReload=
  +ExecReload=/usr/sbin/nft -f /etc/nftables/main.nft

• File[/srv/cfssl]

  Parameters differences:

  --- File[/srv/cfssl].orig
  +++ File[/srv/cfssl]
  
  -    ensure => directory
  -    group  => root
  -    owner  => root
  

• Prometheus::Node_textfile[prometheus-check-mlserve_front_proxy-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-mlserve_front_proxy-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-mlserve_front_proxy-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_front_proxy_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa -profile ocsp /etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Class[Puppet::Agent]

  Parameters differences:

  --- Class[Puppet::Agent].orig
  +++ Class[Puppet::Agent]
  
  @@
  -    dns_alt_names => ['pki.discovery.wmnet']
  +    dns_alt_names => []
  

• File[/lib/systemd/system/cfssl-ocspserve@etcd.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@etcd.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@etcd.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@etcd.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@etcd.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (etcd)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 10005 \
  -          -responses /etc/cfssl/ocsp/etcd.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - mlserve_front_proxy
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --responses-file /etc/cfssl/ocsp/mlserve_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_front_proxy' mlserve_front_proxy 

• Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_zuul]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_zuul].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_zuul]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_zuul command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "373325faaa689f3e9b058d91d4eb6cdb" --timeout 10 --check-command "check_check_certificate_expiry_zuul"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_zuul
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Logrotate::Conf[cfssl-gc-expired-certs]

  Parameters differences:

  --- Logrotate::Conf[cfssl-gc-expired-certs].orig
  +++ Logrotate::Conf[cfssl-gc-expired-certs]
  
  -    ensure => present
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Timer[cfssl-ocsprefresh-wikikube_staging_front_proxy]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-wikikube_staging_front_proxy]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-wikikube_staging_front_proxy.service
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_puppet_rsa].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-puppet_rsa" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-puppet_rsa/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging_front_proxy]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging_front_proxy].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging_front_proxy]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Prometheus::Blackbox::Check::Http[PKI_syslog]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_syslog].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_syslog]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"syslog"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Exec[Generate initial CRL for wikikube_staging]

  Parameters differences:

  --- Exec[Generate initial CRL for wikikube_staging].orig
  +++ Exec[Generate initial CRL for wikikube_staging]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/wikikube_staging
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/wikikube_staging
  

• Systemd::Unit[cfssl-ocsprefresh-discovery.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-discovery.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-discovery.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-discovery.timer
  

• File[/etc/ferm]

  Parameters differences:

  --- File[/etc/ferm].orig
  +++ File[/etc/ferm]
  
  @@
  -    ensure => directory
  +    ensure => absent
  

• Sudo::User[nrpe_certificate_check_wikikube_front_proxy]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_wikikube_front_proxy].orig
  +++ Sudo::User[nrpe_certificate_check_wikikube_front_proxy]
  
  -    user       => nrpe_certificate_check_wikikube_front_proxy
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• Nftables::Set[STAGING_KUBEPODS_NETWORKS]

  Parameters differences:

  --- Nftables::Set[STAGING_KUBEPODS_NETWORKS].orig
  +++ Nftables::Set[STAGING_KUBEPODS_NETWORKS]
  
  +    hosts  => ['10.64.64.0/21', '2620:0:861:babe::/64', '10.192.64.0/21', '2620:0:860:babe::/64']
  +    ensure => present
  

• Exec[renew certificate - OCSP_aux_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_aux_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_aux_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem -checkend 952200
  

• File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Cfssl::Config[dse_front_proxy]

  Parameters differences:

  --- Cfssl::Config[dse_front_proxy].orig
  +++ Cfssl::Config[dse_front_proxy]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/dse_front_proxy/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/dse_front_proxy
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/dse_front_proxy
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages      => ['signing', 'key encipherment', 'client auth']
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_syslog]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_syslog].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_syslog]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_syslog command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "e3b9b989d5062ce2d267023dfe42fcd8" --timeout 10 --check-command "check_check_certificate_expiry_syslog"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_syslog
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-zuul-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-zuul-certificate-expiry --cert-path /etc/cfssl/signers/zuul/ca/zuul.pem --outfile /var/lib/prometheus/node.d/zuul_intermediate.prom

• File[/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• File[/lib/systemd/system/nrpe2nodexp-ferm_active.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-ferm_active.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-ferm_active.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.timer (nrpe2nodexp-ferm_active.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-ferm_active.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-ferm_active.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-ferm_active.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-ferm_active.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=10min
  -OnActiveSec=1s
  -RandomizedDelaySec=600
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/cfssl/signers/puppet_rsa/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/puppet_rsa/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/puppet_rsa/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/puppet_rsa/cfssl.conf.orig
  +++ /etc/cfssl/signers/puppet_rsa/cfssl.conf
  @@ -1,73 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "digital signature",
  -        "key encipherment",
  -        "server auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/puppet_rsa",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/puppet_rsa"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "mtls": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "client auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• File[/etc/nftables/]

  Parameters differences:

  --- File[/etc/nftables/].orig
  +++ File[/etc/nftables/]
  
  +    path    => /etc/nftables
  +    ensure  => directory
  +    purge   => True
  +    recurse => True
  +    owner   => root
  +    group   => root
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Cfssl::Config[zuul]

  Parameters differences:

  --- Cfssl::Config[zuul].orig
  +++ Cfssl::Config[zuul]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/zuul/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/zuul
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/zuul
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages      => ['server auth', 'client auth']
  

• File[/lib/systemd/system/cfssl-ocspserve@mlserve.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@mlserve.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@mlserve.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@mlserve.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@mlserve.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (mlserve)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 20030 \
  -          -responses /etc/cfssl/ocsp/mlserve.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: mlserve
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_mlserve!10
  

• Systemd::Service[cfssl-ocspserve@discovery]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@discovery].orig
  +++ Systemd::Service[cfssl-ocspserve@discovery]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_debmonitor.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_debmonitor.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_debmonitor.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Service[cfssl-ocsprefresh-etcd.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-etcd.timer].orig
  +++ Service[cfssl-ocsprefresh-etcd.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Prometheus::Blackbox::Check::Http[PKI_zuul]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_zuul].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_zuul]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"zuul"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-gc-expired-certs.timer]']
  -    refreshonly => True
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_staging command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_mlserve_staging
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "7cff186656c3cabbca85b5b57d0c8679" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_staging"

• File[/etc/cfssl/signers/aux]

  Parameters differences:

  --- File[/etc/cfssl/signers/aux].orig
  +++ File[/etc/cfssl/signers/aux]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux -profile ocsp /etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• File[/etc/cfssl/signers/dse/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/dse/ca].orig
  +++ File[/etc/cfssl/signers/dse/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• File[/etc/cfssl/signers/dse_front_proxy]

  Parameters differences:

  --- File[/etc/cfssl/signers/dse_front_proxy].orig
  +++ File[/etc/cfssl/signers/dse_front_proxy]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-cloud_wmnet_ca-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry --cert-path /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --outfile /var/lib/prometheus/node.d/cloud_wmnet_ca_intermediate.prom

• File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-discovery.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-discovery.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - discovery
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery/ca/discovery.pem --responses-file /etc/cfssl/ocsp/discovery.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery' discovery 

• File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]']
  -    refreshonly => True
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_kafka.service
  

• Profile::Pki::Multirootca::Monitoring[network_devices]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[network_devices].orig
  +++ Profile::Pki::Multirootca::Monitoring[network_devices]
  
  -    intermediate => network_devices
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/network_devices/ca/network_devices.pem
  

• Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Nrpe::Check[check_check_certificate_expiry_etcd]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_etcd].orig
  +++ Nrpe::Check[check_check_certificate_expiry_etcd]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem
  -    before    => Monitoring::Service[check_certificate_expiry_etcd]
  -    ensure    => present
  -    sudo_user => root
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_cassandra.timer
  

• File[/etc/nftables/input/10_full-monitoring-metrics-access-udp.nft]

  Parameters differences:

  --- File[/etc/nftables/input/10_full-monitoring-metrics-access-udp.nft].orig
  +++ File[/etc/nftables/input/10_full-monitoring-metrics-access-udp.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/input/10_full-monitoring-metrics-access-udp.nft.orig
  +++ /etc/nftables/input/10_full-monitoring-metrics-access-udp.nft
  @@ -0,0 +1,4 @@
  +# Managed by puppet
  +# 
  +ip saddr { 10.64.0.82, 10.64.16.62, 10.64.32.85, 10.64.48.171, 208.80.153.42, 208.80.154.78 } udp dport 1-65535 accept
  +ip6 saddr { 2620:0:860:2:208:80:153:42, 2620:0:861:101:10:64:0:82, 2620:0:861:102:10:64:16:62, 2620:0:861:103:10:64:32:85, 2620:0:861:107:10:64:48:171, 2620:0:861:3:208:80:154:78 } udp dport 1-65535 accept

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-aux-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-aux-certificate-expiry --cert-path /etc/cfssl/signers/aux/ca/aux.pem --outfile /var/lib/prometheus/node.d/aux_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Httpd::Mod_conf[filter]

  Parameters differences:

  --- Httpd::Mod_conf[filter].orig
  +++ Httpd::Mod_conf[filter]
  
  -    mod      => filter
  -    ensure   => present
  -    loadfile => filter.load
  

• File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-discovery2026.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-discovery2026.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - discovery2026
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --responses-file /etc/cfssl/ocsp/discovery2026.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery2026' discovery2026 

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-etcd-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-etcd-certificate-expiry --cert-path /etc/cfssl/signers/etcd/ca/etcd.pem --outfile /var/lib/prometheus/node.d/etcd_intermediate.prom

• File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@syslog]']
  -    refreshonly => True
  

• Httpd::Conf[dummy]

  Parameters differences:

  --- Httpd::Conf[dummy].orig
  +++ Httpd::Conf[dummy]
  
  -    priority  => 0
  -    conf_type => sites
  -    source    => puppet:///modules/httpd/dummy.conf
  -    ensure    => present
  

• File[/etc/apache2/sites-enabled/50-pki-discovery-wmnet.conf]

  Parameters differences:

  --- File[/etc/apache2/sites-enabled/50-pki-discovery-wmnet.conf].orig
  +++ File[/etc/apache2/sites-enabled/50-pki-discovery-wmnet.conf]
  
  -    notify => Service[apache2]
  -    ensure => link
  -    target => /etc/apache2/sites-available/50-pki-discovery-wmnet.conf
  -    owner  => root
  -    group  => root
  

• File[/etc/cfssl/signers/etcd/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/etcd/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/etcd/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/etcd/cfssl.conf.orig
  +++ /etc/cfssl/signers/etcd/cfssl.conf
  @@ -1,65 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "digital signature",
  -        "key encipherment",
  -        "server auth",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/etcd",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/etcd"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Profile::Pki::Multirootca::Monitoring[dse]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[dse].orig
  +++ Profile::Pki::Multirootca::Monitoring[dse]
  
  -    intermediate => dse
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/dse/ca/dse.pem
  

• Cfssl::Config[discovery]

  Parameters differences:

  --- Cfssl::Config[discovery].orig
  +++ Cfssl::Config[discovery]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/discovery/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/discovery
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/discovery
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}
  -    default_usages      => ['digital signature', 'key encipherment', 'server auth']
  

• File[/etc/cfssl/signers/aux/ca/aux.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/aux/ca/aux.pem].orig
  +++ File[/etc/cfssl/signers/aux/ca/aux.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/aux/ca/aux.pem.orig
  +++ /etc/cfssl/signers/aux/ca/aux.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDpjCCAwegAwIBAgIUB83dKT9lbMGOLf38Jx6fmsSa714wCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjBx
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMQwwCgYDVQQDEwNhdXgwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABADhzJSO
  -h264ltJ1CVADYcfi1rIxQOY3gtAsxonZ6CWNueKg0vjvDeL32l+NZ3f2yj2CIzl5
  -sa6sZjXmwAKziuuvCAHmsZDY5gzgBdwhZ6UeGAbwlLMgQajwRvCA2RUMuH8iAd6o
  -QcfZyHQFb0zl9mCHYNkjLT4jpwrL4Lx/DGbmkE/ulqOCAQwwggEIMA4GA1UdDwEB
  -/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSPVQ8kSyOIH5l4
  -1mVGCudJoaowtTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
  -BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
  -bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
  -oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
  -bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCALJuWafVNInsE4Q8
  -tEHYHqhweF6bEArm7d3dqqTjKHuOcrmhXo4rgX5VsXHtI3qq9XGHoik6JUSwgftV
  -Sr+GWrIZAkIAuqmJ5vv2LgFcJWvYDkIPH9HXB9rIwAUHPFJ/iX2Ig9By+ss8nJbU
  -A3Ml/4NKRsXZwwyScmowVWQHfMpv53BsBv8=
  ------END CERTIFICATE-----

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft
  @@ -0,0 +1,8 @@
  +# Autogenerated by puppet
  +set MLSTAGE_KUBEPODS_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 10.194.61.0/24
  +    }
  +}

• File[/srv/cfssl/bundles/wikikube_front_proxy.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/wikikube_front_proxy.pem].orig
  +++ File[/srv/cfssl/bundles/wikikube_front_proxy.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/wikikube_front_proxy.pem.orig
  +++ /srv/cfssl/bundles/wikikube_front_proxy.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDuDCCAxmgAwIBAgIUCqmj+2MwaOqLPb5TPXkbkF/PGkUwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
  -gjELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  -GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
  -aW9uczEdMBsGA1UEAwwUd2lraWt1YmVfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0C
  -AQYFK4EEACMDgYYABAAUuXSlLM/Sq6jmsr6/+aqYnBNDoelW5+uJ8kWFyR/9xaFf
  -hmvvui358ZLmOym6cA1tpoA1+PVZ1sVOE++GDsWQ3QDAG2kk8o0QxpXsCXLWBmJZ
  -92Z/pIO7Fc65qe6XDnuZLEaqbb6VWkqQPI15cL9AhJ8HgNbaoaxrT51MfCrHEteP
  -raOCAQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0G
  -A1UdDgQWBBTlGjpQ7L1N14lCjcKcI/4LLNraBjAfBgNVHSMEGDAWgBQ7raJx5jS9
  -G/yAvzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6
  -Ly9wa2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jv
  -b3RfQ0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21u
  -ZXQvY3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GM
  -ADCBiAJCAYT0XLJdjumemn8jpqv058zb+c+3zb+05EhNcj15wcjRUq8SU+c2+H8a
  -hzfph97+CVSvGaV6Cf7phTSEBDPk9+T4AkIBdOmzIcRH+K9UcDzvdxqerOiXJaBC
  -0Bgbg9dOhcd6d0j3CObOuIp760FFQLSli2ocG3WLkfNsXlL1/3+VL+yarNo=
  ------END CERTIFICATE-----

• Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-wikikube_staging-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_intermediate.prom

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse_front_proxy].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
  

• File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Cfssl::Config[syslog]

  Parameters differences:

  --- Cfssl::Config[syslog].orig
  +++ Cfssl::Config[syslog]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/syslog/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/syslog
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/syslog
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages      => ['digital signature', 'key encipherment', 'server auth', 'client auth']
  

• Ferm::Service[ssh_from_cumin_masters]

  Parameters differences:

  --- Ferm::Service[ssh_from_cumin_masters].orig
  +++ Ferm::Service[ssh_from_cumin_masters]
  
  -    ensure              => present
  -    port                => 22
  -    prio                => 10
  -    desc                => 
  -    src_sets            => ['CUMIN_MASTERS']
  -    proto               => tcp
  -    unrestricted_access => False
  -    notrack             => False
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
  

• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-wikikube_front_proxy.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-wikikube_front_proxy.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft.orig
  +++ /etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft
  @@ -0,0 +1,7 @@
  +# Autogenerated by puppet
  +set LABSTORE_HOSTS_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:2:208:80:154:142,
  +             2620:0:861:3:208:80:154:71
  +    }
  +}

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_debmonitor]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Nftables::Set[WIKIKUBE_KUBEPODS_NETWORKS]

  Parameters differences:

  --- Nftables::Set[WIKIKUBE_KUBEPODS_NETWORKS].orig
  +++ Nftables::Set[WIKIKUBE_KUBEPODS_NETWORKS]
  
  +    hosts  => ['10.67.128.0/17', '2620:0:861:cabe::/64', '10.194.128.0/17', '2620:0:860:cabe::/64']
  +    ensure => present
  

• Exec[renew certificate - OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cloud_wmnet_ca -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/nftables/sets/CACHES_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/CACHES_ipv4.nft].orig
  +++ File[/etc/nftables/sets/CACHES_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/CACHES_ipv4.nft.orig
  +++ /etc/nftables/sets/CACHES_ipv4.nft
  @@ -0,0 +1,117 @@
  +# Autogenerated by puppet
  +set CACHES_ipv4 {
  +    type ipv4_addr
  +    elements = { 10.64.0.79,
  +             10.64.0.229,
  +             10.64.0.14,
  +             10.64.0.51,
  +             10.64.16.241,
  +             10.64.16.94,
  +             10.64.16.95,
  +             10.64.16.240,
  +             10.64.32.14,
  +             10.64.32.60,
  +             10.64.32.15,
  +             10.64.32.65,
  +             10.64.48.16,
  +             10.64.48.41,
  +             10.64.48.27,
  +             10.64.48.28,
  +             10.192.23.26,
  +             10.192.6.20,
  +             10.192.12.35,
  +             10.192.14.25,
  +             10.192.4.22,
  +             10.192.29.26,
  +             10.192.30.29,
  +             10.192.36.19,
  +             10.192.40.25,
  +             10.192.41.21,
  +             10.192.56.3,
  +             10.192.56.4,
  +             10.192.57.3,
  +             10.192.58.2,
  +             10.192.58.3,
  +             10.192.59.2,
  +             10.80.0.14,
  +             10.80.1.11,
  +             10.80.0.13,
  +             10.80.1.9,
  +             10.80.0.12,
  +             10.80.1.7,
  +             10.80.0.11,
  +             10.80.1.6,
  +             10.80.0.10,
  +             10.80.1.5,
  +             10.80.0.8,
  +             10.80.1.4,
  +             10.80.0.7,
  +             10.80.1.3,
  +             10.80.0.6,
  +             10.80.1.2,
  +             10.128.0.19,
  +             10.128.0.27,
  +             10.128.0.22,
  +             10.128.0.28,
  +             10.128.0.25,
  +             10.128.0.29,
  +             10.128.0.26,
  +             10.128.0.31,
  +             10.128.0.14,
  +             10.128.0.35,
  +             10.128.0.21,
  +             10.128.0.36,
  +             10.128.0.24,
  +             10.128.0.10,
  +             10.128.0.37,
  +             10.128.0.12,
  +             10.132.0.17,
  +             10.132.0.18,
  +             10.132.0.19,
  +             10.132.0.24,
  +             10.132.0.29,
  +             10.132.0.30,
  +             10.132.0.34,
  +             10.132.0.35,
  +             10.132.0.36,
  +             10.132.0.37,
  +             10.132.0.38,
  +             10.132.0.25,
  +             10.132.0.26,
  +             10.132.0.27,
  +             10.132.0.28,
  +             10.132.0.16,
  +             10.136.0.6,
  +             10.136.1.6,
  +             10.136.0.7,
  +             10.136.1.7,
  +             10.136.0.8,
  +             10.136.1.8,
  +             10.136.0.9,
  +             10.136.1.9,
  +             10.136.0.10,
  +             10.136.1.10,
  +             10.136.0.11,
  +             10.136.1.11,
  +             10.136.0.12,
  +             10.136.1.12,
  +             10.136.0.13,
  +             10.136.1.13,
  +             10.140.0.3,
  +             10.140.1.4,
  +             10.140.0.4,
  +             10.140.1.5,
  +             10.140.0.5,
  +             10.140.1.6,
  +             10.140.0.6,
  +             10.140.1.7,
  +             10.140.0.7,
  +             10.140.1.8,
  +             10.140.0.8,
  +             10.140.1.9,
  +             10.140.0.9,
  +             10.140.1.10,
  +             10.140.0.10,
  +             10.140.1.11
  +    }
  +}

• Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• File[/etc/nftables/sets]

  Parameters differences:

  --- File[/etc/nftables/sets].orig
  +++ File[/etc/nftables/sets]
  
  +    ensure  => directory
  +    purge   => True
  +    recurse => True
  +    owner   => root
  +    group   => root
  

• File[/usr/local/bin/prometheus-check-wikikube-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-wikikube-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-wikikube-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft
  @@ -0,0 +1,189 @@
  +# Autogenerated by puppet
  +set PRODUCTION_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 10.128.0.0/24,
  +             10.128.1.0/24,
  +             10.128.2.0/24,
  +             10.132.0.0/24,
  +             10.132.2.0/24,
  +             10.136.0.0/24,
  +             10.136.1.0/24,
  +             10.140.0.0/24,
  +             10.140.1.0/24,
  +             10.140.2.0/24,
  +             10.192.0.0/22,
  +             10.192.10.0/24,
  +             10.192.11.0/24,
  +             10.192.12.0/24,
  +             10.192.13.0/24,
  +             10.192.14.0/24,
  +             10.192.15.0/24,
  +             10.192.16.0/22,
  +             10.192.20.0/24,
  +             10.192.21.0/24,
  +             10.192.22.0/24,
  +             10.192.23.0/24,
  +             10.192.24.0/23,
  +             10.192.26.0/24,
  +             10.192.27.0/24,
  +             10.192.28.0/24,
  +             10.192.29.0/24,
  +             10.192.30.0/24,
  +             10.192.31.0/24,
  +             10.192.32.0/22,
  +             10.192.36.0/24,
  +             10.192.37.0/24,
  +             10.192.38.0/24,
  +             10.192.39.0/24,
  +             10.192.4.0/24,
  +             10.192.40.0/24,
  +             10.192.41.0/24,
  +             10.192.42.0/24,
  +             10.192.43.0/24,
  +             10.192.44.0/24,
  +             10.192.45.0/24,
  +             10.192.46.0/24,
  +             10.192.47.0/24,
  +             10.192.48.0/22,
  +             10.192.5.0/24,
  +             10.192.52.0/24,
  +             10.192.56.0/24,
  +             10.192.57.0/24,
  +             10.192.58.0/24,
  +             10.192.59.0/24,
  +             10.192.6.0/24,
  +             10.192.64.0/21,
  +             10.192.7.0/24,
  +             10.192.72.0/24,
  +             10.192.76.0/24,
  +             10.192.8.0/24,
  +             10.192.80.0/20,
  +             10.192.9.0/24,
  +             10.192.96.0/21,
  +             10.194.0.0/20,
  +             10.194.128.0/17,
  +             10.194.16.0/21,
  +             10.194.61.0/24,
  +             10.194.62.0/23,
  +             10.194.64.0/20,
  +             10.194.80.0/21,
  +             10.2.1.0/24,
  +             10.2.2.0/24,
  +             10.2.3.0/24,
  +             10.2.4.0/24,
  +             10.2.5.0/24,
  +             10.2.6.0/24,
  +             10.2.7.0/24,
  +             10.64.0.0/22,
  +             10.64.130.0/24,
  +             10.64.131.0/24,
  +             10.64.132.0/24,
  +             10.64.133.0/24,
  +             10.64.134.0/24,
  +             10.64.135.0/24,
  +             10.64.136.0/24,
  +             10.64.137.0/24,
  +             10.64.138.0/24,
  +             10.64.139.0/24,
  +             10.64.140.0/24,
  +             10.64.141.0/24,
  +             10.64.142.0/24,
  +             10.64.143.0/24,
  +             10.64.144.0/24,
  +             10.64.145.0/24,
  +             10.64.148.0/24,
  +             10.64.149.0/24,
  +             10.64.150.0/24,
  +             10.64.151.0/24,
  +             10.64.152.0/24,
  +             10.64.153.0/24,
  +             10.64.154.0/24,
  +             10.64.155.0/24,
  +             10.64.156.0/24,
  +             10.64.157.0/24,
  +             10.64.158.0/24,
  +             10.64.159.0/24,
  +             10.64.16.0/22,
  +             10.64.160.0/24,
  +             10.64.161.0/24,
  +             10.64.162.0/24,
  +             10.64.163.0/24,
  +             10.64.164.0/24,
  +             10.64.165.0/24,
  +             10.64.166.0/24,
  +             10.64.167.0/24,
  +             10.64.169.0/24,
  +             10.64.170.0/24,
  +             10.64.171.0/24,
  +             10.64.172.0/24,
  +             10.64.173.0/24,
  +             10.64.174.0/24,
  +             10.64.175.0/24,
  +             10.64.176.0/24,
  +             10.64.177.0/24,
  +             10.64.178.0/24,
  +             10.64.179.0/24,
  +             10.64.180.0/24,
  +             10.64.181.0/24,
  +             10.64.182.0/24,
  +             10.64.183.0/24,
  +             10.64.184.0/24,
  +             10.64.185.0/24,
  +             10.64.186.0/24,
  +             10.64.187.0/24,
  +             10.64.188.0/24,
  +             10.64.189.0/24,
  +             10.64.190.0/24,
  +             10.64.20.0/24,
  +             10.64.21.0/24,
  +             10.64.24.0/23,
  +             10.64.32.0/22,
  +             10.64.36.0/24,
  +             10.64.48.0/22,
  +             10.64.5.0/24,
  +             10.64.53.0/24,
  +             10.64.64.0/21,
  +             10.64.72.0/24,
  +             10.64.76.0/24,
  +             10.67.0.0/20,
  +             10.67.128.0/17,
  +             10.67.16.0/21,
  +             10.67.24.0/21,
  +             10.67.32.0/20,
  +             10.67.64.0/20,
  +             10.67.80.0/21,
  +             10.80.0.0/24,
  +             10.80.1.0/24,
  +             10.80.2.0/24,
  +             103.102.166.0/28,
  +             103.102.166.224/27,
  +             103.102.166.96/27,
  +             185.15.58.0/27,
  +             185.15.58.224/27,
  +             185.15.58.32/27,
  +             185.15.59.0/27,
  +             185.15.59.224/27,
  +             185.15.59.32/27,
  +             185.15.59.96/27,
  +             195.200.68.0/27,
  +             195.200.68.224/27,
  +             195.200.68.32/27,
  +             195.200.68.96/27,
  +             198.35.26.0/27,
  +             198.35.26.32/27,
  +             198.35.26.96/27,
  +             208.80.152.128/27,
  +             208.80.153.0/27,
  +             208.80.153.224/27,
  +             208.80.153.32/27,
  +             208.80.153.64/27,
  +             208.80.153.96/27,
  +             208.80.154.0/26,
  +             208.80.154.128/26,
  +             208.80.154.224/27,
  +             208.80.154.64/26,
  +             208.80.155.96/27
  +    }
  +}

• Exec[Generate initial CRL for dse]

  Parameters differences:

  --- Exec[Generate initial CRL for dse].orig
  +++ Exec[Generate initial CRL for dse]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/dse/ca/dse.pem /etc/cfssl/signers/dse/ca/dse-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/dse
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/dse
  

• File[/etc/cfssl/signers/cassandra/ca/cassandra.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/cassandra/ca/cassandra.pem].orig
  +++ File[/etc/cfssl/signers/cassandra/ca/cassandra.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/cassandra/ca/cassandra.pem.orig
  +++ /etc/cfssl/signers/cassandra/ca/cassandra.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDqjCCAw2gAwIBAgIUN8PPoG0JeyUfDWKQhN0B2AOw4G8wCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjE5MTI1MDAwWhcNMjgwNjE3MTI1MDAwWjB3
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRIwEAYDVQQDEwljYXNzYW5kcmEwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
  -BABpd+xtElegZM2bsg1caGxmHV5hs7l7qxmKFS3oSAu1jo1+N/uSppDtSWZzG+8C
  -zjIrytBMxBWhNqsOw9msEWhbBAEYESw1oKj+APqOlCafGdXQI1ZvMafexxTqDNN1
  -CA2gq4ivn82r2Ya3LLqwICxK3MlcmGuLwR5amxiLchok3cZ3X6OCAQwwggEIMA4G
  -A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQBN6m6
  -eyaSV8l2Il/bwcfpWTmplDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
  -NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
  -ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
  -BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
  -ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GKADCBhgJBRhCSOg5L
  -+EuYGdsW8T9S/tXzYURZpnQItn2nYjM6ky1nxqG6F+V2WsiijiPpEQxr7QUvfZhf
  -D2zhB5BS8ynWCpYCQRGo4eZuUHyRMNqg/ZDljT1dqr09n0wQhszrJ4eCmebLVsDm
  -B6AM3pPRygYo0REwxHbpTBAIt26zjGiKiFQqUjwa
  ------END CERTIFICATE-----

• File[/lib/systemd/system/cfssl-ocspserve@puppet_rsa.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@puppet_rsa.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@puppet_rsa.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@puppet_rsa.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@puppet_rsa.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (puppet_rsa)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 10008 \
  -          -responses /etc/cfssl/ocsp/puppet_rsa.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Exec[renew certificate - OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_aux_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Cfssl::Cert[OCSP_aux_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_aux_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_aux_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => aux
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@aux]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-aux]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_cloud_wmnet_ca_f87f54115f2f782169eed72541c30a1e]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_cloud_wmnet_ca_f87f54115f2f782169eed72541c30a1e].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_cloud_wmnet_ca_f87f54115f2f782169eed72541c30a1e]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="f87f54115f2f782169eed72541c30a1e",check_name="check_check_certificate_expiry_cloud_wmnet_ca", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__cloud_wmnet_ca
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_cloud_wmnet_ca))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@wikikube_front_proxy]']
  -    refreshonly => True
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-wikikube-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-wikikube-certificate-expiry --cert-path /etc/cfssl/signers/wikikube/ca/wikikube.pem --outfile /var/lib/prometheus/node.d/wikikube_intermediate.prom

• Service[nrpe2nodexp-check_certificate_expiry_zuul.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_zuul.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_zuul.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]']
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_cassandra" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_network_devices]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_network_devices].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_network_devices]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem].orig
  +++ File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem

• Sudo::User[nrpe-check_check_certificate_expiry_wikikube_front_proxy]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_wikikube_front_proxy].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_wikikube_front_proxy]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem']
  -    tag        => nrpe::check
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_debmonitor]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_debmonitor].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_debmonitor]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Nrpe::Check[check_check_certificate_expiry_wikikube_staging]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_wikikube_staging].orig
  +++ Nrpe::Check[check_check_certificate_expiry_wikikube_staging]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
  -    before    => Monitoring::Service[check_certificate_expiry_wikikube_staging]
  -    ensure    => present
  -    sudo_user => root
  

• Prometheus::Blackbox::Check::Http[PKI_etcd]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_etcd].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_etcd]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"etcd"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]']
  -    refreshonly => True
  

• Exec[Generate initial CRL for cassandra]

  Parameters differences:

  --- Exec[Generate initial CRL for cassandra].orig
  +++ Exec[Generate initial CRL for cassandra]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/cassandra/ca/cassandra.pem /etc/cfssl/signers/cassandra/ca/cassandra-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/cassandra
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/cassandra
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_cfssl-multirootca_status" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem

• Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label syslog -profile ocsp /etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/lib/systemd/system/wmf_auto_restart_ulogd2.service]

  Parameters differences:

  --- File[/lib/systemd/system/wmf_auto_restart_ulogd2.service].orig
  +++ File[/lib/systemd/system/wmf_auto_restart_ulogd2.service]
  
  -    notify => Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.service (wmf_auto_restart_ulogd2.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/wmf_auto_restart_ulogd2.service.orig
  +++ /lib/systemd/system/wmf_auto_restart_ulogd2.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Auto restart job: ulogd2
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/wmf-auto-restart -s ulogd2

• Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-wikikube_staging_front_proxy" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Systemd::Service[nrpe2nodexp-ferm_active]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-ferm_active].orig
  +++ Systemd::Service[nrpe2nodexp-ferm_active]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-ferm_active.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Logrotate::Conf[cfssl-ocsprefresh-puppet_rsa]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-puppet_rsa].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-puppet_rsa]
  
  -    ensure => present
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_etcd]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_etcd].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_etcd]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_etcd command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "c834f873297e445663ead81279c0b928" --timeout 10 --check-command "check_check_certificate_expiry_etcd"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_etcd
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Monitoring::Exported_nagios_service[pki1001 disk_space]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 disk_space].orig
  +++ Monitoring::Exported_nagios_service[pki1001 disk_space]
  
  @@
  -    servicegroups         => pki_eqiad
  +    servicegroups         => insetup_eqiad
  @@
  -    notifications_enabled => 1
  +    notifications_enabled => 0
  

• File[/etc/sudoers.d/nrpe_certificate_check_cloud_wmnet_ca]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_cloud_wmnet_ca].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_cloud_wmnet_ca]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Service[cfssl-ocspserve@mlserve_staging_front_proxy]

  Parameters differences:

  --- Service[cfssl-ocspserve@mlserve_staging_front_proxy].orig
  +++ Service[cfssl-ocspserve@mlserve_staging_front_proxy]
  
  -    ensure => running
  -    enable => True
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer
  

• Systemd::Unit[cfssl-ocsprefresh-dse.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-dse.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-dse.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-dse.service
  

• Cfssl::Ocsp[dse_front_proxy]

  Parameters differences:

  --- Cfssl::Ocsp[dse_front_proxy].orig
  +++ Cfssl::Ocsp[dse_front_proxy]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 20062
  -    db_driver          => mysql
  

• File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/etc/cfssl/signers/zuul/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/zuul/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/zuul/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/zuul/cfssl.conf.orig
  +++ /etc/cfssl/signers/zuul/cfssl.conf
  @@ -1,63 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "server auth",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/zuul",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/zuul"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/var/log/wmf_auto_restart_apache-htcacheclean]

  Parameters differences:

  --- File[/var/log/wmf_auto_restart_apache-htcacheclean].orig
  +++ File[/var/log/wmf_auto_restart_apache-htcacheclean]
  
  -    backup => False
  -    ensure => absent
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/srv/cfssl/bundles/aux_front_proxy.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/aux_front_proxy.pem].orig
  +++ File[/srv/cfssl/bundles/aux_front_proxy.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/aux_front_proxy.pem.orig
  +++ /srv/cfssl/bundles/aux_front_proxy.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDsjCCAxOgAwIBAgIUcL3aZt8/kOKuFw8g90SCOk9VZSYwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjB9
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRgwFgYDVQQDDA9hdXhfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
  -ACMDgYYABAFQamNeMXOM8jZDTMiL/0Cgk641Tps3tMBQ6f1OD7fqLh7JGWZXSWIE
  -9v25H6dgcqSIWAlvBkbHQUPU51GmXigXtwCW1bYWFZc+MTjXFo2LBUJVUIxh2mh3
  -pNZYlgVZXP7a0l3zt2u5vegKRuJ6l0ELtjCJjo/TNYo/BA28XrzCL45HO6OCAQww
  -ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
  -BBQv7ovDzaQTat1sfWJFkZ+n8+aGSTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
  -g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
  -ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
  -SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
  -L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
  -AZ7oTip5kp2Yt9BABNEqYi6GjwpXZvmZOgd6So8UA76jP8duYicuOoNvpoHdEy58
  -ZOGpo0lqqIzB8xQcvzvmX7uiAkIAxHVKylOLCoPsUXaZVfUGhNavXXwrbIHTQXDo
  -HEHmc9lIMh9hO5z4vPMEbMkSRuAskcT1K/ydEqp4xI191jnovUg=
  ------END CERTIFICATE-----

• Monitoring::Service[check_certificate_expiry_kafka]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_kafka].orig
  +++ Monitoring::Service[check_certificate_expiry_kafka]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: kafka
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_kafka!10
  

• File[/srv/cfssl/bundles/mlserve_staging.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/mlserve_staging.pem].orig
  +++ File[/srv/cfssl/bundles/mlserve_staging.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/mlserve_staging.pem.orig
  +++ /srv/cfssl/bundles/mlserve_staging.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDsjCCAxOgAwIBAgIUHWrqd3I2VME7z6A5M3brKa5UlOgwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB9
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRgwFgYDVQQDDA9tbHNlcnZlX3N0YWdpbmcwgZswEAYHKoZIzj0CAQYFK4EE
  -ACMDgYYABAAu0g2dBBEAH2iUfZLPv+mA+1srb6S3bdVyH/kRk+QZDoOMnM0H8Edn
  -V+dakFKXnwl+w+qsOsWj1NP2FlOm3bTglwCIxFAzX5XaDfqWa74L1tIqDH6kx+bX
  -yxnuGWT/U1cv8rIHFap7ccH3h5YxPQfHy73KRTWxPln6ByswgxekotwnCKOCAQww
  -ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
  -BBSRzdapYuh57Gp5MstVlUJNJ+6zTzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
  -g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
  -ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
  -SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
  -L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
  -AY8VuLFo6MpcfxrDG8Junk8mESfQTMRbfeZM6WpHqKYBTESkpeV8HIdTYliFDAMX
  -JqE94+xbPVaTS8DZ0xiXz4SjAkIBEIIXA4nOdLYbX/MvdKWr7aDunH8n1oO3K/op
  -7NktfJd5CXuECxdSonHOb7PFW5lbpCtZrLxFzhB2Hlp1TBWHX84=
  ------END CERTIFICATE-----

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
  

• File[/etc/apache2/sites-available/50-pki-discovery-wmnet.conf]

  Parameters differences:

  --- File[/etc/apache2/sites-available/50-pki-discovery-wmnet.conf].orig
  +++ File[/etc/apache2/sites-available/50-pki-discovery-wmnet.conf]
  
  -    notify => Service[apache2]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/apache2/sites-available/50-pki-discovery-wmnet.conf.orig
  +++ /etc/apache2/sites-available/50-pki-discovery-wmnet.conf
  @@ -1,149 +0,0 @@
  -#####################################################################
  -
  -### THIS FILE IS MANAGED BY PUPPET
  -#####################################################################
  -# vim: filetype=apache
  -<VirtualHost *:80>
  -  ServerName pki.discovery.wmnet
  -  ServerAlias pki1001.eqiad.wmnet
  -  DocumentRoot /srv/cfssl
  -
  -  <Directory  /srv/cfssl>
  -    Require all granted
  -  </Directory>
  -
  -  <Location /metrics>
  -    Require host prometheus1005.eqiad.wmnet prometheus1006.eqiad.wmnet prometheus1007.eqiad.wmnet prometheus1008.eqiad.wmnet
  -    ProxyPass http://127.0.0.1:8888/metrics
  -    ProxyPassReverse http://127.0.0.1:8888/metrics
  -  </Location>
  -
  -  # Wikimedia_Internal_Root_CA
  -  ProxyPass /ocsp/Wikimedia_Internal_Root_CA  http://localhost:10000/
  -  ProxyPassReverse /ocsp/Wikimedia_Internal_Root_CA  http://localhost:10000/
  -  # debmonitor
  -  ProxyPass /ocsp/debmonitor  http://localhost:10001/
  -  ProxyPassReverse /ocsp/debmonitor  http://localhost:10001/
  -  # discovery
  -  ProxyPass /ocsp/discovery  http://localhost:10002/
  -  ProxyPassReverse /ocsp/discovery  http://localhost:10002/
  -  # kafka
  -  ProxyPass /ocsp/kafka  http://localhost:10003/
  -  ProxyPassReverse /ocsp/kafka  http://localhost:10003/
  -  # cloud_wmnet_ca
  -  ProxyPass /ocsp/cloud_wmnet_ca  http://localhost:10004/
  -  ProxyPassReverse /ocsp/cloud_wmnet_ca  http://localhost:10004/
  -  # etcd
  -  ProxyPass /ocsp/etcd  http://localhost:10005/
  -  ProxyPassReverse /ocsp/etcd  http://localhost:10005/
  -  # cassandra
  -  ProxyPass /ocsp/cassandra  http://localhost:10006/
  -  ProxyPassReverse /ocsp/cassandra  http://localhost:10006/
  -  # syslog
  -  ProxyPass /ocsp/syslog  http://localhost:10007/
  -  ProxyPassReverse /ocsp/syslog  http://localhost:10007/
  -  # puppet_rsa
  -  ProxyPass /ocsp/puppet_rsa  http://localhost:10008/
  -  ProxyPassReverse /ocsp/puppet_rsa  http://localhost:10008/
  -  # zuul
  -  ProxyPass /ocsp/zuul  http://localhost:10009/
  -  ProxyPassReverse /ocsp/zuul  http://localhost:10009/
  -  # discovery2026
  -  ProxyPass /ocsp/discovery2026  http://localhost:10010/
  -  ProxyPassReverse /ocsp/discovery2026  http://localhost:10010/
  -  # wikikube
  -  ProxyPass /ocsp/wikikube  http://localhost:20010/
  -  ProxyPassReverse /ocsp/wikikube  http://localhost:20010/
  -  # wikikube_front_proxy
  -  ProxyPass /ocsp/wikikube_front_proxy  http://localhost:20011/
  -  ProxyPassReverse /ocsp/wikikube_front_proxy  http://localhost:20011/
  -  # wikikube_staging
  -  ProxyPass /ocsp/wikikube_staging  http://localhost:20020/
  -  ProxyPassReverse /ocsp/wikikube_staging  http://localhost:20020/
  -  # wikikube_staging_front_proxy
  -  ProxyPass /ocsp/wikikube_staging_front_proxy  http://localhost:20021/
  -  ProxyPassReverse /ocsp/wikikube_staging_front_proxy  http://localhost:20021/
  -  # mlserve
  -  ProxyPass /ocsp/mlserve  http://localhost:20030/
  -  ProxyPassReverse /ocsp/mlserve  http://localhost:20030/
  -  # mlserve_front_proxy
  -  ProxyPass /ocsp/mlserve_front_proxy  http://localhost:20031/
  -  ProxyPassReverse /ocsp/mlserve_front_proxy  http://localhost:20031/
  -  # mlserve_staging
  -  ProxyPass /ocsp/mlserve_staging  http://localhost:20040/
  -  ProxyPassReverse /ocsp/mlserve_staging  http://localhost:20040/
  -  # mlserve_staging_front_proxy
  -  ProxyPass /ocsp/mlserve_staging_front_proxy  http://localhost:20041/
  -  ProxyPassReverse /ocsp/mlserve_staging_front_proxy  http://localhost:20041/
  -  # aux
  -  ProxyPass /ocsp/aux  http://localhost:20050/
  -  ProxyPassReverse /ocsp/aux  http://localhost:20050/
  -  # aux_front_proxy
  -  ProxyPass /ocsp/aux_front_proxy  http://localhost:20051/
  -  ProxyPassReverse /ocsp/aux_front_proxy  http://localhost:20051/
  -  # dse
  -  ProxyPass /ocsp/dse  http://localhost:20061/
  -  ProxyPassReverse /ocsp/dse  http://localhost:20061/
  -  # dse_front_proxy
  -  ProxyPass /ocsp/dse_front_proxy  http://localhost:20062/
  -  ProxyPassReverse /ocsp/dse_front_proxy  http://localhost:20062/
  -  # network_devices
  -  ProxyPass /ocsp/network_devices  http://localhost:20063/
  -  ProxyPassReverse /ocsp/network_devices  http://localhost:20063/
  -
  -  LogLevel warn
  -  ErrorLog /var/log/apache2/pki.discovery.wmnet_error.log
  -  CustomLog /var/log/apache2/pki.discovery.wmnet_access.log wmf
  -</VirtualHost>
  -
  -<VirtualHost *:443>
  -  # Protected by client auth
  -  ServerName pki.discovery.wmnet
  -  ServerAlias pki1001.eqiad.wmnet
  -  DocumentRoot /srv/cfssl
  -
  -  SSLEngine on
  -  SSLCertificateFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem
  -  SSLCertificateKeyFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem
  -  SSLCertificateChainFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem
  -  SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
  -  SSLCipherSuite -ALL:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256
  -  SSLCipherSuite TLSv1.3 TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
  -  SSLHonorCipherOrder On
  -  SSLOpenSSLConfCmd DHParameters "/etc/ssl/dhparam.pem"
  -  Header always set Strict-Transport-Security "max-age=106384710; includeSubDomains; preload"
  -  SSLVerifyClient require
  -  SSLVerifyDepth 2
  -  SSLCACertificateFile /etc/ssl/localcerts/multiroot_ca.pem
  -
  -  ProxyPass /  http://127.0.0.1:8888/
  -  ProxyPassReverse / http://127.0.0.1:8888/
  -
  -  LogLevel warn ssl:info
  -  ErrorLog /var/log/apache2/pki.discovery.wmnet_ssl_error.log
  -  CustomLog /var/log/apache2/pki.discovery.wmnet_ssl_access.log wmf
  -</VirtualHost>
  -<VirtualHost *:8443>
  -  # Protected by iptables
  -  ServerName pki.discovery.wmnet
  -  ServerAlias pki1001.eqiad.wmnet
  -  DocumentRoot /srv/cfssl
  -
  -  SSLEngine on
  -  SSLCertificateFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem
  -  SSLCertificateKeyFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem
  -  SSLCertificateChainFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem
  -  SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
  -  SSLCipherSuite -ALL:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256
  -  SSLCipherSuite TLSv1.3 TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
  -  SSLHonorCipherOrder On
  -  SSLOpenSSLConfCmd DHParameters "/etc/ssl/dhparam.pem"
  -  Header always set Strict-Transport-Security "max-age=106384710; includeSubDomains; preload"
  -
  -  ProxyPass /  http://127.0.0.1:8888/
  -  ProxyPassReverse / http://127.0.0.1:8888/
  -
  -  LogLevel warn ssl:info
  -  ErrorLog /var/log/apache2/pki.discovery.wmnet_k8s_error.log
  -  CustomLog /var/log/apache2/pki.discovery.wmnet_k8s_access.log wmf
  -</VirtualHost>

• File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem].orig
  +++ File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem.orig
  +++ /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem
  @@ -1 +0,0 @@
  -test

• File[/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_syslog]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_syslog].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_syslog]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_syslog.service
  

• Prometheus::Node_textfile[prometheus-check-mlserve_staging-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-mlserve_staging-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-mlserve_staging-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Prometheus::Blackbox::Check::Http[PKI_kafka]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_kafka].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_kafka]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"kafka"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-etcd.timer]']
  -    refreshonly => True
  

• File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Cfssl::Signer[kafka]

  Parameters differences:

  --- Cfssl::Signer[kafka].orig
  +++ Cfssl::Signer[kafka]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/kafka/ca/kafka.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDqDCCAwmgAwIBAgIUTWT2navXkMW9fz3oUB7Fc6azbKcwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjExMDI4MTMwNjAwWhcNMjYxMDI3MTMwNjAwWjBz
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMQ4wDAYDVQQDEwVrYWZrYTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAScI
  AVY36upnobdfvpQJ7Y5uefRAv0OsdtR++HEqm2kTatOG4BJTdjdBv3+gyd3rJccd
  DEifyU1EcxVVXjjXzqdHADiJ+Zol5mwexbnrpF8JDBiJv7ntNamdr7Xjv4kw8Tkp
  kgl70aFalPLjpwjDNyrm2ACxPmHxK8EOu7eXb8RImqeVo4IBDDCCAQgwDgYDVR0P
  AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFGIY/nB0tTtl
  RGdO5J4ck+RM8p8rMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2MFYG
  CCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zlcnku
  d21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBB
  MD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1lZGlh
  X0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBv8ZMP7g8aPkc
  tcrO4rXcBkhFIWH9+4H4iTbuSBtjVtUXdsRW++IU89BjVVKQxv/4ZDm8hlpd+vJU
  b9xj3WUpi8cCQgFpjYqKVM+I5eRpIjhWoPxognJtGI3626wAOpV2CPauciD51gP3
  up2xe36OG3Z8XDcbNGoNiG3505+af9zBrt3c4g==
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => 
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/kafka
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/kafka
  -    ca_key_file      => /etc/cfssl/signers/kafka/ca/kafka-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'kafka_11': {'expiry': '8760h'}}
  -    default_usages   => ['digital signature', 'key encipherment', 'server auth', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• Exec[renew certificate - OCSP_etcd_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_etcd_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_etcd_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label etcd -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Monitoring::Service[check_certificate_expiry_wikikube]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_wikikube].orig
  +++ Monitoring::Service[check_certificate_expiry_wikikube]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: wikikube
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_wikikube!10
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_aux]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem

• File[/var/log/cfssl-ocsprefresh-cassandra]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-cassandra].orig
  +++ File[/var/log/cfssl-ocsprefresh-cassandra]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
  
  -    ensure => present
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_wikikube
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "d2a76a31e44e204e2d4788a2698d0e6c" --timeout 10 --check-command "check_check_certificate_expiry_wikikube"

• File[/etc/cfssl/signers/discovery/ca/discovery.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/discovery/ca/discovery.pem].orig
  +++ File[/etc/cfssl/signers/discovery/ca/discovery.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/discovery/ca/discovery.pem.orig
  +++ /etc/cfssl/signers/discovery/ca/discovery.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDrDCCAw2gAwIBAgIUcVMxEVtp5xErDjx/jInOFcUaRjkwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjEwNTA0MTM1NDAwWhcNMjYwNTAzMTM1NDAwWjB3
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRIwEAYDVQQDEwlkaXNjb3ZlcnkwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
  -BAG7X6lQ05D8EQYwPd+v2qT12Y35j/YQTaOEbAuKQJBshTdMizCxGe4GUB33Nivw
  -3B0o9EcyCQokcUCUGtVlI3U0QQArB+LuehDTw7D5JKwOUK5GpSG5YlNL7Kg2c3gI
  -wyck1+Z5yDMIsclW5FtaM1IIFeUIOXrulmih3zM4PPrVtP3Vh6OCAQwwggEIMA4G
  -A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSJ76Rw
  -5IjvCdxrdGkh4PHUL7PCBjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
  -NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
  -ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
  -BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
  -ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAeamwKAw
  -q+lKC/GdcPuP2SOoyij0+LFWucrQwxxiCiXlMAhSnj3fkKk5G5pLoFnY2X7hB0w4
  -ZPtLXG7If9pmIDjwAkIBwnJUYLz3dJTbZudeUJFX4yD49liKTYMPDpl/HWKSh9m4
  -4PZKXsAIs4CT29jwwtmsLK1HkPB0ShO8Egm/KB5dLUs=
  ------END CERTIFICATE-----

• File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_cfssl-multirootca_status.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_cfssl-multirootca_status.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=5min
  -OnActiveSec=1s
  -RandomizedDelaySec=300
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem].orig
  +++ File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem.orig
  +++ /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDuDCCAxmgAwIBAgIUCqmj+2MwaOqLPb5TPXkbkF/PGkUwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
  -gjELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  -GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
  -aW9uczEdMBsGA1UEAwwUd2lraWt1YmVfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0C
  -AQYFK4EEACMDgYYABAAUuXSlLM/Sq6jmsr6/+aqYnBNDoelW5+uJ8kWFyR/9xaFf
  -hmvvui358ZLmOym6cA1tpoA1+PVZ1sVOE++GDsWQ3QDAG2kk8o0QxpXsCXLWBmJZ
  -92Z/pIO7Fc65qe6XDnuZLEaqbb6VWkqQPI15cL9AhJ8HgNbaoaxrT51MfCrHEteP
  -raOCAQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0G
  -A1UdDgQWBBTlGjpQ7L1N14lCjcKcI/4LLNraBjAfBgNVHSMEGDAWgBQ7raJx5jS9
  -G/yAvzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6
  -Ly9wa2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jv
  -b3RfQ0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21u
  -ZXQvY3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GM
  -ADCBiAJCAYT0XLJdjumemn8jpqv058zb+c+3zb+05EhNcj15wcjRUq8SU+c2+H8a
  -hzfph97+CVSvGaV6Cf7phTSEBDPk9+T4AkIBdOmzIcRH+K9UcDzvdxqerOiXJaBC
  -0Bgbg9dOhcd6d0j3CObOuIp760FFQLSli2ocG3WLkfNsXlL1/3+VL+yarNo=
  ------END CERTIFICATE-----

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
  
  -    ensure => present
  

• File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem].orig
  +++ File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem.orig
  +++ /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDsjCCAxOgAwIBAgIUBGeKXglKnoXGyRgWodaHSfz0z/gwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjB9
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRgwFgYDVQQDDA9kc2VfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
  -ACMDgYYABAGUNx07sN1MWk3DzjEFh3pfYaQVrqo1tWFQjf7URfwqfyZY81Tqt6yl
  -y/zj3DpvtOmvyI5jPH91yPBaFho0/SpP6wFkBIyE8/Ik2b80slPKuzstrYgBlYsG
  -+Fxop4CYWjLItOy1Ut82aYr76hNm0goEma9ETjgE4nfBEU3vi77QO/B9E6OCAQww
  -ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
  -BBQPHxMmkuy8EqO+Wz7TmM1MfmcXDDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
  -g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
  -ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
  -SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
  -L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
  -AO3JNb9OyC3JQ3mmkgt+Db3NMgLArYlvcYd8Nd5uWEXm6d6NfUPDN5XBGkjly1B7
  -N18vKQYxlZzX2wgYqaK9LYs9AkIBch3vTND/M2T78Hhp5YoodasCdLDcpMJ1Qn3T
  -fI0Lwjt7W50T0FMle6CwZkI+ZrxRzqvic19IUSTDDqwiOFgLhqM=
  ------END CERTIFICATE-----

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
  

• File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_zuul]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_zuul].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_zuul]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-cassandra.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-cassandra.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-cassandra.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-cassandra.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]']
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_network_devices.timer
  

• Systemd::Unit[cfssl-ocspserve@mlserve_staging]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@mlserve_staging].orig
  +++ Systemd::Unit[cfssl-ocspserve@mlserve_staging]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@mlserve_staging
  

• File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft
  @@ -0,0 +1,9 @@
  +# Autogenerated by puppet
  +set DSE_KUBEPODS_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 10.67.24.0/21,
  +             10.192.96.0/21
  +    }
  +}

• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_staging_front_proxy command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "e515778a769f523fb98a7f642670e011" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_staging_front_proxy"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Logrotate::Conf[cfssl-ocsprefresh-dse]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-dse].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-dse]
  
  -    ensure => present
  

• File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem].orig
  +++ File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem.orig
  +++ /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem
  @@ -1 +0,0 @@
  -nosecret

• File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_aux.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_aux.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Systemd::Syslog[cfssl-ocsprefresh-kafka]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-kafka].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-kafka]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Prometheus::Node_textfile[prometheus-check-wikikube-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-wikikube-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-wikikube-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-wikikube-certificate-expiry --cert-path /etc/cfssl/signers/wikikube/ca/wikikube.pem --outfile /var/lib/prometheus/node.d/wikikube_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• File[/usr/local/bin/prometheus-check-cassandra-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-cassandra-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-cassandra-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• File[/etc/sudoers.d/nrpe-check_ferm_active]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_ferm_active].orig
  +++ File[/etc/sudoers.d/nrpe-check_ferm_active]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_ferm_active.orig
  +++ /etc/sudoers.d/nrpe-check_ferm_active
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/local/lib/nagios/plugins/check_ferm

• Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@etcd]']
  -    refreshonly => True
  

• Systemd::Service[cfssl-ocsprefresh-debmonitor]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-debmonitor].orig
  +++ Systemd::Service[cfssl-ocsprefresh-debmonitor]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-debmonitor.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]']
  -    refreshonly => True
  

• File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/srv/cfssl/bundles/wikikube_staging_front_proxy.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/wikikube_staging_front_proxy.pem].orig
  +++ File[/srv/cfssl/bundles/wikikube_staging_front_proxy.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/wikikube_staging_front_proxy.pem.orig
  +++ /srv/cfssl/bundles/wikikube_staging_front_proxy.pem
  @@ -1,23 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDwDCCAyGgAwIBAgIUJT4TJHFy4qcc2DDVjG00p9VDOcIwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
  -ijELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  -GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
  -aW9uczElMCMGA1UEAwwcd2lraWt1YmVfc3RhZ2luZ19mcm9udF9wcm94eTCBmzAQ
  -BgcqhkjOPQIBBgUrgQQAIwOBhgAEAQkWDUaTmBFtrLcFLkOP5LV+kGQdr0TIYAMX
  -FR7UbUmysish4+UlH7C2vcugX/XmmIoh2asGRkfb0kjTQUUjqDmmANYQARMmx/V4
  -j87yMi11K3IxBh2Ei7KJzvXD5yhg/rQa1TVcdvZ1GHBL1QvBU5x2L95G+Exi1amQ
  -dC4vktygtdo8o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB
  -Af8CAQEwHQYDVR0OBBYEFANI4okfmz36Vpe1jEq4tkgKl5HzMB8GA1UdIwQYMBaA
  -FDutonHmNL0b/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcw
  -AYY6aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50
  -ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2Nv
  -dmVyeS53bW5ldC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZI
  -zj0EAwQDgYwAMIGIAkIBuKBFQ/g6puAs+HK7+bE4eiatpN7eotPUTNbVuxN4+rEO
  -E6JEpXslb/Ad0rVDvEOmXGSH9EdqjCNJs0Qv5kFnqZQCQgCPyFWGoBUxDcWLjOEL
  -2a1pt4joI2BUut3NtLOBgPeaI/5qqPoLFbxn/1DMBmZLlsoNhnrg99F5LgvQVEAA
  -/3y5tw==
  ------END CERTIFICATE-----

• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer
  

• Nftables::Set[INSTALL_HOSTS]

  Parameters differences:

  --- Nftables::Set[INSTALL_HOSTS].orig
  +++ Nftables::Set[INSTALL_HOSTS]
  
  +    hosts  => ['208.80.154.134', '208.80.153.70', '185.15.59.101', '198.35.26.98', '103.102.166.11', '185.15.58.7', '195.200.68.100', '2620:0:861:2:208:80:154:134', '2620:0:860:3:208:80:153:70', '2a02:ec80:300:3:185:15:59:101', '2620:0:863:3:198:35:26:98', '2001:df2:e500:1:103:102:166:11', '2a02:ec80:600:1:185:15:58:7', '2a02:ec80:700:3:195:200:68:100']
  +    ensure => present
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-zuul-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]']
  -    refreshonly => True
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Prometheus::Node_textfile[prometheus-check-dse_front_proxy-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-dse_front_proxy-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-dse_front_proxy-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --outfile /var/lib/prometheus/node.d/dse_front_proxy_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Systemd::Unit[cfssl-ocspserve@debmonitor]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@debmonitor].orig
  +++ Systemd::Unit[cfssl-ocspserve@debmonitor]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@debmonitor
  

• Systemd::Unit[cfssl-ocsprefresh-zuul.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-zuul.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-zuul.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-zuul.service
  

• Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]
  
  -    ensure => present
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/nftables/sets/LABS_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/LABS_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/LABS_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/LABS_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/LABS_NETWORKS_ipv4.nft
  @@ -0,0 +1,27 @@
  +# Autogenerated by puppet
  +set LABS_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 172.16.0.0/21,
  +             172.16.128.0/24,
  +             172.16.129.0/24,
  +             172.16.130.0/24,
  +             172.16.131.0/24,
  +             172.16.16.0/21,
  +             172.16.24.0/24,
  +             172.16.8.0/21,
  +             172.20.1.0/24,
  +             172.20.2.0/24,
  +             172.20.254.0/24,
  +             172.20.255.0/24,
  +             172.20.3.0/24,
  +             172.20.4.0/24,
  +             172.20.5.0/24,
  +             185.15.56.0/25,
  +             185.15.56.160/28,
  +             185.15.57.0/29,
  +             185.15.57.16/29,
  +             185.15.57.24/29
  +    }
  +}

• File[/etc/cfssl/ocsp/cassandra.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/cassandra.ocsp].orig
  +++ File[/etc/cfssl/ocsp/cassandra.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-wikikube_staging.service
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_dse_front_proxy" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• Cfssl::Signer[discovery]

  Parameters differences:

  --- Cfssl::Signer[discovery].orig
  +++ Cfssl::Signer[discovery]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/discovery/ca/discovery.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDrDCCAw2gAwIBAgIUcVMxEVtp5xErDjx/jInOFcUaRjkwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjEwNTA0MTM1NDAwWhcNMjYwNTAzMTM1NDAwWjB3
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMRIwEAYDVQQDEwlkaXNjb3ZlcnkwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
  BAG7X6lQ05D8EQYwPd+v2qT12Y35j/YQTaOEbAuKQJBshTdMizCxGe4GUB33Nivw
  3B0o9EcyCQokcUCUGtVlI3U0QQArB+LuehDTw7D5JKwOUK5GpSG5YlNL7Kg2c3gI
  wyck1+Z5yDMIsclW5FtaM1IIFeUIOXrulmih3zM4PPrVtP3Vh6OCAQwwggEIMA4G
  A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSJ76Rw
  5IjvCdxrdGkh4PHUL7PCBjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
  NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
  ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
  BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
  ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAeamwKAw
  q+lKC/GdcPuP2SOoyij0+LFWucrQwxxiCiXlMAhSnj3fkKk5G5pLoFnY2X7hB0w4
  ZPtLXG7If9pmIDjwAkIBwnJUYLz3dJTbZudeUJFX4yD49liKTYMPDpl/HWKSh9m4
  4PZKXsAIs4CT29jwwtmsLK1HkPB0ShO8Egm/KB5dLUs=
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => ##### FAKE FOR PUPPET ######
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/discovery
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/discovery
  -    ca_key_file      => /etc/cfssl/signers/discovery/ca/discovery-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}
  -    default_usages   => ['digital signature', 'key encipherment', 'server auth']
  -    serve_service    => cfssl-multirootca
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_discovery]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem

• Systemd::Unit[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@Wikimedia_Internal_Root_CA].orig
  +++ Systemd::Unit[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@Wikimedia_Internal_Root_CA
  

• Service[cfssl-ocspserve@aux_front_proxy]

  Parameters differences:

  --- Service[cfssl-ocspserve@aux_front_proxy].orig
  +++ Service[cfssl-ocspserve@aux_front_proxy]
  
  -    ensure => running
  -    enable => True
  

• Cfssl::Ocsp[cassandra]

  Parameters differences:

  --- Cfssl::Ocsp[cassandra].orig
  +++ Cfssl::Ocsp[cassandra]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/cassandra/ca/cassandra.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 10006
  -    db_driver          => mysql
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-debmonitor.timer]']
  -    refreshonly => True
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-wikikube_front_proxy" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-wikikube_front_proxy/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer].orig
  +++ Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-network_devices-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-network_devices-certificate-expiry --cert-path /etc/cfssl/signers/network_devices/ca/network_devices.pem --outfile /var/lib/prometheus/node.d/network_devices_intermediate.prom

• Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]']
  -    refreshonly => True
  

• Systemd::Override[ferm-service-status-restart]

  Parameters differences:

  --- Systemd::Override[ferm-service-status-restart].orig
  +++ Systemd::Override[ferm-service-status-restart]
  
  -    source  => puppet:///modules/ferm/ferm_systemd_override
  -    ensure  => present
  -    restart => False
  -    unit    => ferm
  

• Monitoring::Service[check_certificate_expiry_syslog]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_syslog].orig
  +++ Monitoring::Service[check_certificate_expiry_syslog]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: syslog
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_syslog!10
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Systemd::Service[cfssl-ocspserve@puppet_rsa]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@puppet_rsa].orig
  +++ Systemd::Service[cfssl-ocspserve@puppet_rsa]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Class[Profile::Firewall]

  Parameters differences:

  --- Class[Profile::Firewall].orig
  +++ Class[Profile::Firewall]
  
  @@
  -    provider => ferm
  +    provider => nftables
  

• File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]']
  -    refreshonly => True
  

• File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-debmonitor.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-debmonitor.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Sudo::User[nrpe-check_check_certificate_expiry_mlserve_front_proxy]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_mlserve_front_proxy].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_mlserve_front_proxy]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem']
  -    tag        => nrpe::check
  

• Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_cfssl-multirootca_status.service
  

• File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft].orig
  +++ File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft.orig
  +++ /etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft
  @@ -0,0 +1,11 @@
  +# Autogenerated by puppet
  +set ZOOKEEPER_HOSTS_MAIN_ipv4 {
  +    type ipv4_addr
  +    elements = { 10.64.0.207,
  +             10.64.16.110,
  +             10.64.48.154,
  +             10.192.16.45,
  +             10.192.32.52,
  +             10.192.48.59
  +    }
  +}

• Nrpe::Monitor_service[check_certificate_expiry_etcd]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_etcd].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_etcd]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: etcd
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem
  -    timeout                     => 10
  

• File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft.orig
  +++ /etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft
  @@ -0,0 +1,10 @@
  +# Autogenerated by puppet
  +set DRUID_PUBLIC_HOSTS_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:10a:10:64:131:9,
  +             2620:0:861:10b:10:64:132:12,
  +             2620:0:861:10e:10:64:135:9,
  +             2620:0:861:103:10:64:32:101,
  +             2620:0:861:107:10:64:48:185
  +    }
  +}

• Sudo::User[nrpe_certificate_check_wikikube_staging_front_proxy]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_wikikube_staging_front_proxy].orig
  +++ Sudo::User[nrpe_certificate_check_wikikube_staging_front_proxy]
  
  -    user       => nrpe_certificate_check_wikikube_staging_front_proxy
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
  

• File[/var/log/cfssl-ocsprefresh-discovery2026]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-discovery2026].orig
  +++ File[/var/log/cfssl-ocsprefresh-discovery2026]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
  
  -    ensure => present
  

• Augeas[Apache2 logs]

  Parameters differences:

  --- Augeas[Apache2 logs].orig
  +++ Augeas[Apache2 logs]
  
  -    require => Package[apache2]
  -    changes => ['set rule/schedule daily', 'set rule/rotate 30']
  -    incl    => /etc/logrotate.d/apache2
  -    lens    => Logrotate.lns
  

• File[/etc/sudoers.d/nrpe_certificate_check_cassandra]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_cassandra].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_cassandra]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-zuul.timer]']
  -    refreshonly => True
  

• Monitoring::Service[check_certificate_expiry_mlserve]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_mlserve].orig
  +++ Monitoring::Service[check_certificate_expiry_mlserve]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: mlserve
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_mlserve!10
  

• File[/etc/nftables/sets/INSTALL_HOSTS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/INSTALL_HOSTS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/INSTALL_HOSTS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/INSTALL_HOSTS_ipv6.nft.orig
  +++ /etc/nftables/sets/INSTALL_HOSTS_ipv6.nft
  @@ -0,0 +1,12 @@
  +# Autogenerated by puppet
  +set INSTALL_HOSTS_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:2:208:80:154:134,
  +             2620:0:860:3:208:80:153:70,
  +             2a02:ec80:300:3:185:15:59:101,
  +             2620:0:863:3:198:35:26:98,
  +             2001:df2:e500:1:103:102:166:11,
  +             2a02:ec80:600:1:185:15:58:7,
  +             2a02:ec80:700:3:195:200:68:100
  +    }
  +}

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• File[/srv/cfssl/bundles/zuul.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/zuul.pem].orig
  +++ File[/srv/cfssl/bundles/zuul.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/zuul.pem.orig
  +++ /srv/cfssl/bundles/zuul.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDpzCCAwigAwIBAgIUMIxkteGnxVGRNFWjJZ+eXPnOeM8wCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjUwODIwMTg1NTAwWhcNMzAwODE5MTg1NTAwWjBy
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMQ0wCwYDVQQDEwR6dXVsMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBNx/m
  -dSpc4EWI68Y36PVvDkvyqlJ6pA4sEXQCrNOM+0jSACRM8Shwqr7uC/JmuP8GIdK3
  -g+SgxQOjF9pfelX2OpAB6leOfgHXhFtzJquX261tKsxQm74cszycF9YTiWDKVq0V
  -g7bFNgf4NcC7NxGfN4SuA58I7dQWJxSWdzTJNQsF2uijggEMMIIBCDAOBgNVHQ8B
  -Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUqyQEoVfbsJqL
  -jr5RyZovCpWdRZUwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
  -KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
  -bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
  -P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
  -SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgER9R3mwAtzYcIh
  -HAnL2SiHTXBpqitQp6Ce+7nYFP0qyu+Ggkx2bu86bl32lGmvA6ecTKXDiyXW5pMW
  -atmKn0wAegJCAaU9pfWuLIgsVqzB2zvDWMR2HgBMa6MO7dRlG2VUoLvR16NF9cln
  -XjNzIqPRxUpiD5TNC4+p9BoT+RRXEDUeRufH
  ------END CERTIFICATE-----

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_etcd]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_etcd].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_etcd]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• File[/etc/cfssl/ocsp/mlserve_front_proxy.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/mlserve_front_proxy.ocsp].orig
  +++ File[/etc/cfssl/ocsp/mlserve_front_proxy.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

  Parameters differences:

  --- Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA].orig
  +++ Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
  
  -    ensure => running
  -    enable => True
  

• File[/etc/ferm/conf.d/01_drop-blocked-nets]

  Parameters differences:

  --- File[/etc/ferm/conf.d/01_drop-blocked-nets].orig
  +++ File[/etc/ferm/conf.d/01_drop-blocked-nets]
  
  -    notify  => Service[ferm]
  -    require => File[/etc/ferm/conf.d]
  -    ensure  => present
  -    owner   => root
  -    tag     => ferm
  -    mode    => 0400
  -    group   => root
  

  Content differences:

  --- /etc/ferm/conf.d/01_drop-blocked-nets.orig
  +++ /etc/ferm/conf.d/01_drop-blocked-nets
  @@ -1,11 +0,0 @@
  -# Autogenerated by puppet. DO NOT EDIT BY HAND!
  -#
  -# 01_drop-blocked-nets: drop abuse/blocked_nets.yaml defined in the requestctl private repo
  -
  -domain (ip ip6) {
  -	table filter {
  -		chain INPUT {
  -			saddr $BLOCKED_NETS DROP;
  -		}
  -	}
  -}

• Httpd::Mod_conf[access_compat]

  Parameters differences:

  --- Httpd::Mod_conf[access_compat].orig
  +++ Httpd::Mod_conf[access_compat]
  
  -    mod      => access_compat
  -    ensure   => present
  -    loadfile => access_compat.load
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/cfssl/signers/cassandra]

  Parameters differences:

  --- File[/etc/cfssl/signers/cassandra].orig
  +++ File[/etc/cfssl/signers/cassandra]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-cloud_wmnet_ca.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-cloud_wmnet_ca.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Timer[wmf_auto_restart_apache-htcacheclean]

  Parameters differences:

  --- Systemd::Timer[wmf_auto_restart_apache-htcacheclean].orig
  +++ Systemd::Timer[wmf_auto_restart_apache-htcacheclean]
  
  -    fixed_random_delay => False
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 3:51:00'}]
  -    unit_name          => wmf_auto_restart_apache-htcacheclean.service
  

• Cfssl::Ocsp[kafka]

  Parameters differences:

  --- Cfssl::Ocsp[kafka].orig
  +++ Cfssl::Ocsp[kafka]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/kafka/ca/kafka.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 10003
  -    db_driver          => mysql
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/ssl/localcerts/multiroot_ca.pem]

  Parameters differences:

  --- File[/etc/ssl/localcerts/multiroot_ca.pem].orig
  +++ File[/etc/ssl/localcerts/multiroot_ca.pem]
  
  -    notify => Service[apache2]
  -    ensure => file
  -    owner  => root
  -    source => puppet:///modules/profile/pki/production/client_auth_CA.pem
  -    mode   => 0440
  -    group  => root
  

• Prometheus::Blackbox::Check::Http[PKI_cassandra]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_cassandra].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_cassandra]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"cassandra"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
  

• File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft].orig
  +++ File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft.orig
  +++ /etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft
  @@ -0,0 +1,11 @@
  +# Autogenerated by puppet
  +set ZOOKEEPER_HOSTS_MAIN_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:101:10:64:0:207,
  +             2620:0:861:102:10:64:16:110,
  +             2620:0:861:107:10:64:48:154,
  +             2620:0:860:102:10:192:16:45,
  +             2620:0:860:103:10:192:32:52,
  +             2620:0:860:104:10:192:48:59
  +    }
  +}

• Nrpe::Check[check_check_certificate_expiry_discovery]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_discovery].orig
  +++ Nrpe::Check[check_check_certificate_expiry_discovery]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem
  -    before    => Monitoring::Service[check_certificate_expiry_discovery]
  -    ensure    => present
  -    sudo_user => root
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-syslog]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-syslog].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-syslog]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-syslog.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-syslog
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-syslog
  -
  -/var/log/cfssl-ocsprefresh-syslog/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/lib/systemd/system/cfssl-ocsprefresh-zuul.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-zuul.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-zuul.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-zuul.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-zuul.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-zuul.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-zuul.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Exec[renew certificate - OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - mlserve_staging
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --responses-file /etc/cfssl/ocsp/mlserve_staging.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_staging' mlserve_staging 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Service[cfssl-ocsprefresh-mlserve_staging]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-mlserve_staging].orig
  +++ Systemd::Service[cfssl-ocsprefresh-mlserve_staging]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_wikikube_staging_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem

• File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• File[/etc/cfssl/ocsp/etcd.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/etcd.ocsp].orig
  +++ File[/etc/cfssl/ocsp/etcd.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem].orig
  +++ File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem.orig
  +++ /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem
  @@ -1 +0,0 @@
  -test

• Systemd::Unit[cfssl-ocsprefresh-etcd.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-etcd.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-etcd.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-etcd.service
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-zuul]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-zuul].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-zuul]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-zuul.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-zuul
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-zuul
  -
  -/var/log/cfssl-ocsprefresh-zuul/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/usr/local/bin/prometheus-check-discovery2026-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-discovery2026-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-discovery2026-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• File[/srv/cfssl/bundles/mlserve_staging_front_proxy.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/mlserve_staging_front_proxy.pem].orig
  +++ File[/srv/cfssl/bundles/mlserve_staging_front_proxy.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/mlserve_staging_front_proxy.pem.orig
  +++ /srv/cfssl/bundles/mlserve_staging_front_proxy.pem
  @@ -1,23 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDvjCCAyCgAwIBAgIUV8ha2UdjViI49Xr/fZzbY4YPZdYwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
  -iTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  -GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
  -aW9uczEkMCIGA1UEAwwbbWxzZXJ2ZV9zdGFnaW5nX2Zyb250X3Byb3h5MIGbMBAG
  -ByqGSM49AgEGBSuBBAAjA4GGAAQAyrMiWBRjOWCaMXsvXC0wS6VzHyLLGFT8BpM9
  -EhYcloDfNnb8no2+YXrBzj4+lAg3D3dq53q+hyHko3+YsVVF/qABa55syWkYtxDB
  -xy5FNq6Iq/s2E3vO2YpQifWXlaSZvvuZCGhhTPDOp/zdI/kKdco9Jehsu6CdyElj
  -lCgJTZupZCmjggEMMIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB
  -/wIBATAdBgNVHQ4EFgQUj5l8xt65hr4t5yj8xKYmUsKwk9YwHwYDVR0jBBgwFoAU
  -O62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzAB
  -hjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRl
  -cm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292
  -ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjO
  -PQQDBAOBiwAwgYcCQgD24XA2cP2pFwE3onWEosbFqDEaFwD5kNg7eSOkncJIceFU
  -bCX1f6VOYSv6UbiEQV0EwS0d34EawydbLcqXqfHgpgJBJJjdNhpjAcwyRt1+unRc
  -dYn6ys1ZElRXMld7NUq+nCInX5cVk8uPeSev6IxIJc2eyBCb4jtjvE3TAQ2RHvT9
  -sBI=
  ------END CERTIFICATE-----

• File[/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf.orig
  +++ /etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf
  @@ -1,64 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "signing",
  -        "key encipherment",
  -        "client auth"
  -      ],
  -      "expiry": "72h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/wikikube_staging_front_proxy",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/wikikube_staging_front_proxy"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer].orig
  +++ Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Systemd::Unit[cfssl-ocsprefresh-syslog.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-syslog.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-syslog.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-syslog.service
  

• Cfssl::Config[wikikube_staging_front_proxy]

  Parameters differences:

  --- Cfssl::Config[wikikube_staging_front_proxy].orig
  +++ Cfssl::Config[wikikube_staging_front_proxy]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 72h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/wikikube_staging_front_proxy
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/wikikube_staging_front_proxy
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages      => ['signing', 'key encipherment', 'client auth']
  

• File[/etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp].orig
  +++ File[/etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Exec[renew certificate - OCSP_cassandra_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_cassandra_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_cassandra_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cassandra -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft.orig
  +++ /etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft
  @@ -0,0 +1,4 @@
  +# Autogenerated by puppet
  +set MYSQL_ROOT_CLIENTS_ipv6 {
  +    type ipv6_addr
  +}

• Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem].orig
  +++ File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem.orig
  +++ /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
  @@ -1,30 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIFNDCCBJagAwIBAgIUOR+ZAFtrzLKYphDIGMa9eF6O0LIwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjIwMTIwNTAwWhcNMjgwNjE4MTIwNTAwWjB4
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRMwEQYDVQQDDApwdXBwZXRfcnNhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
  -MIICCgKCAgEA4urK5Og7RVGoXg6KzYywzaXyRROuj0Kauc7n/BgCWvsKv9Ll4f/p
  -lbVGOSln3akzhBlJwmVTGrgCmWQVxMF2agKAR+R1aV2Wc+yEfofUbW1oRgBCelMQ
  -Xutw0cApO+lzjHNtduffeIEVBjwLcEG/OdaUa2CGFGLG/dHox7o8AZgkH7SFJyby
  -z/rzip+szHpMThhjs0PKx91VS1srb7Q1jE1OlB7ydhX+gLRWTjwxOp1ITFXjNobk
  -i16jcP3YYgCvj8qwWMcYmtI7iExSeFdptv3fmajBeoi1o52LUWKUrslwtNa/emaB
  -FBGRZfu8ap+BWWpYYarI4mOCyvetw/6FZ2LnuWy5cNA3GoALB5xfLpO3twYnrveP
  -BnxULp4Q8szITB/bjPBMkd8FG8Frpe3eZNKNHG9xjJGdS1Bxhq7Zgfy09V1RJCym
  -AJSWERHRrxjEnRCDd7HUAhfaDCygeooe4wGRR5bG8WqOpkQDtYPP3yfk5NBhcJpW
  -mXTRFTFkuslEL/2bwa9EPIOAKAINDeJOCHqJMQd6EXwTP2LabWU3oI+sfeBdCoSd
  -Rn+q2Z0kSLu8fqXsgPgvdgyWjfPkQnyLAz9rdsal2x4x9SilDkov+l6Q9DXGGoYO
  -GGOHHFCFhM9CS02zFGLe1JbqiHPuYuIkEnGjGJyCqdIB8Rz0JxdypEcCAwEAAaOC
  -AQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1Ud
  -DgQWBBRrq/ZHBKl8OZGQrQCiUq4GRc86YDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yA
  -vzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9w
  -a2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3Rf
  -Q0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQv
  -Y3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCB
  -hwJBJHrjuBvyK8Sv40xCW/TrVtOCIVaXfjwsKau9lkmt/6purO/xkppZDMajueYw
  -9koKhj6SvliOpiwgypfOKP7nbsACQgFAnawARDYCoOQ8pQDoqpRkPBBScMOTMPFu
  -xTekxW2V7POn9dn6uavLJz/wha+sNgAnYT4wHWkRJzbUk+1H3Hb3NA==
  ------END CERTIFICATE-----

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_zuul]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem

• Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.timer (wmf_auto_restart_ulogd2.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.timer (wmf_auto_restart_ulogd2.timer)].orig
  +++ Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.timer (wmf_auto_restart_ulogd2.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[wmf_auto_restart_ulogd2.timer]']
  -    refreshonly => True
  

• File[/etc/apache2/sites-enabled/00-dummy.conf]

  Parameters differences:

  --- File[/etc/apache2/sites-enabled/00-dummy.conf].orig
  +++ File[/etc/apache2/sites-enabled/00-dummy.conf]
  
  -    notify => Service[apache2]
  -    ensure => link
  -    target => /etc/apache2/sites-available/00-dummy.conf
  -    owner  => root
  -    group  => root
  

• Httpd::Mod_conf[status]

  Parameters differences:

  --- Httpd::Mod_conf[status].orig
  +++ Httpd::Mod_conf[status]
  
  -    mod      => status
  -    ensure   => present
  -    loadfile => status.load
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-cloud_wmnet_ca
  -
  -/var/log/cfssl-ocsprefresh-cloud_wmnet_ca/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Httpd::Mod_conf[headers]

  Parameters differences:

  --- Httpd::Mod_conf[headers].orig
  +++ Httpd::Mod_conf[headers]
  
  -    mod      => headers
  -    ensure   => present
  -    loadfile => headers.load
  

• File[/etc/sudoers.d/nrpe_certificate_check_discovery]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_discovery].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_discovery]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft
  @@ -0,0 +1,9 @@
  +# Autogenerated by puppet
  +set WIKIKUBE_KUBEPODS_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2620:0:861:cabe::/64,
  +             2620:0:860:cabe::/64
  +    }
  +}

• File[/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_puppet_rsa]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_puppet_rsa].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_puppet_rsa]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: puppet_rsa
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_puppet_rsa!10
  

• File[/etc/logrotate.d/wmf_auto_restart_apache-htcacheclean]

  Parameters differences:

  --- File[/etc/logrotate.d/wmf_auto_restart_apache-htcacheclean].orig
  +++ File[/etc/logrotate.d/wmf_auto_restart_apache-htcacheclean]
  
  -    ensure => absent
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/wmf_auto_restart_apache-htcacheclean.orig
  +++ /etc/logrotate.d/wmf_auto_restart_apache-htcacheclean
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for wmf_auto_restart_apache-htcacheclean
  -
  -/var/log/wmf_auto_restart_apache-htcacheclean/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Prometheus::Node_textfile[prometheus-check-cassandra-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-cassandra-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-cassandra-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-cassandra-certificate-expiry --cert-path /etc/cfssl/signers/cassandra/ca/cassandra.pem --outfile /var/lib/prometheus/node.d/cassandra_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]']
  -    refreshonly => True
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_dse_front_proxy command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_dse_front_proxy
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "2560f4f577ba169af651cf96bd5dc1ba" --timeout 10 --check-command "check_check_certificate_expiry_dse_front_proxy"

• Systemd::Service[cfssl-ocsprefresh-network_devices]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-network_devices].orig
  +++ Systemd::Service[cfssl-ocsprefresh-network_devices]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-network_devices.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/lib/systemd/system/cfssl-ocspserve@cassandra.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@cassandra.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@cassandra.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@cassandra.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@cassandra.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (cassandra)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 10006 \
  -          -responses /etc/cfssl/ocsp/cassandra.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
  

• Motd::Script[insetup::infrastructure_foundations_nftables]

  Parameters differences:

  --- Motd::Script[insetup::infrastructure_foundations_nftables].orig
  +++ Motd::Script[insetup::infrastructure_foundations_nftables]
  
  +    priority => 5
  +    ensure   => present
  

• File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft
  @@ -0,0 +1,9 @@
  +# Autogenerated by puppet
  +set AUX_KUBEPODS_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 10.67.80.0/21,
  +             10.194.80.0/21
  +    }
  +}

• File[/srv/cfssl/bundles/kafka.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/kafka.pem].orig
  +++ File[/srv/cfssl/bundles/kafka.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/kafka.pem.orig
  +++ /srv/cfssl/bundles/kafka.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDqDCCAwmgAwIBAgIUTWT2navXkMW9fz3oUB7Fc6azbKcwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjExMDI4MTMwNjAwWhcNMjYxMDI3MTMwNjAwWjBz
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMQ4wDAYDVQQDEwVrYWZrYTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAScI
  -AVY36upnobdfvpQJ7Y5uefRAv0OsdtR++HEqm2kTatOG4BJTdjdBv3+gyd3rJccd
  -DEifyU1EcxVVXjjXzqdHADiJ+Zol5mwexbnrpF8JDBiJv7ntNamdr7Xjv4kw8Tkp
  -kgl70aFalPLjpwjDNyrm2ACxPmHxK8EOu7eXb8RImqeVo4IBDDCCAQgwDgYDVR0P
  -AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFGIY/nB0tTtl
  -RGdO5J4ck+RM8p8rMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2MFYG
  -CCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zlcnku
  -d21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBB
  -MD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1lZGlh
  -X0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBv8ZMP7g8aPkc
  -tcrO4rXcBkhFIWH9+4H4iTbuSBtjVtUXdsRW++IU89BjVVKQxv/4ZDm8hlpd+vJU
  -b9xj3WUpi8cCQgFpjYqKVM+I5eRpIjhWoPxognJtGI3626wAOpV2CPauciD51gP3
  -up2xe36OG3Z8XDcbNGoNiG3505+af9zBrt3c4g==
  ------END CERTIFICATE-----

• Sudo::User[nrpe_certificate_check_aux]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_aux].orig
  +++ Sudo::User[nrpe_certificate_check_aux]
  
  -    user       => nrpe_certificate_check_aux
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_aux_f7dfe9e2cd77303dfae7ae11c5c56d90]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_aux_f7dfe9e2cd77303dfae7ae11c5c56d90].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_aux_f7dfe9e2cd77303dfae7ae11c5c56d90]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: aux
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="f7dfe9e2cd77303dfae7ae11c5c56d90",check_name="check_check_certificate_expiry_aux", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__aux
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: aux
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_aux))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_zuul]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_zuul].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_zuul]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: zuul
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_zuul!10
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer
  

• Service[cfssl-ocspserve@dse]

  Parameters differences:

  --- Service[cfssl-ocspserve@dse].orig
  +++ Service[cfssl-ocspserve@dse]
  
  -    ensure => running
  -    enable => True
  

• Nftables::Set[DSE_KUBEPODS_NETWORKS]

  Parameters differences:

  --- Nftables::Set[DSE_KUBEPODS_NETWORKS].orig
  +++ Nftables::Set[DSE_KUBEPODS_NETWORKS]
  
  +    hosts  => ['10.67.24.0/21', '2620:0:861:302::/64', '10.192.96.0/21', '2620:0:860:308::/64']
  +    ensure => present
  

• Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - cloud_wmnet_ca
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --responses-file /etc/cfssl/ocsp/cloud_wmnet_ca.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@cloud_wmnet_ca' cloud_wmnet_ca 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/lib/systemd/system/cfssl-ocspserve@debmonitor.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@debmonitor.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@debmonitor.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@debmonitor.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@debmonitor.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (debmonitor)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 10001 \
  -          -responses /etc/cfssl/ocsp/debmonitor.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/apache2/env-available]

  Parameters differences:

  --- File[/etc/apache2/env-available].orig
  +++ File[/etc/apache2/env-available]
  
  -    require => Package[apache2]
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0755
  -    group   => root
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/etc/ferm/conf.d/00_defs_requestctl]

  Parameters differences:

  --- File[/etc/ferm/conf.d/00_defs_requestctl].orig
  +++ File[/etc/ferm/conf.d/00_defs_requestctl]
  
  @@
  -    ensure => file
  +    ensure => absent
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-cloud_wmnet_ca-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry --cert-path /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --outfile /var/lib/prometheus/node.d/cloud_wmnet_ca_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.service (wmf_auto_restart_ulogd2.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.service (wmf_auto_restart_ulogd2.service)].orig
  +++ Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.service (wmf_auto_restart_ulogd2.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Nftables::Service[ssh-from-bastion]

  Parameters differences:

  --- Nftables::Service[ssh-from-bastion].orig
  +++ Nftables::Service[ssh-from-bastion]
  
  +    ensure              => present
  +    src_ips             => ['103.102.166.103', '185.15.58.6', '185.15.59.99', '195.200.68.99', '198.35.26.104', '2001:df2:e500:3:103:102:166:103', '208.80.153.110', '208.80.154.7', '2620:0:860:4:208:80:153:110', '2620:0:861:1:208:80:154:7', '2620:0:863:3:198:35:26:104', '2a02:ec80:300:3:185:15:59:99', '2a02:ec80:600:1:185:15:58:6', '2a02:ec80:700:3:195:200:68:99']
  +    port                => 22
  +    prio                => 10
  +    desc                => 
  +    proto               => tcp
  +    unrestricted_access => False
  +    notrack             => False
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer
  

• File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/etc/cfssl/signers/debmonitor/ca/debmonitor.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/debmonitor/ca/debmonitor.pem].orig
  +++ File[/etc/cfssl/signers/debmonitor/ca/debmonitor.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/debmonitor/ca/debmonitor.pem.orig
  +++ /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDqzCCAw6gAwIBAgIUD8gl+8iTKG2ZJ9eRsZs5/C9/7ZMwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMzE0MTM0NTAwWhcNMjgwMzEyMTM0NTAwWjB4
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRMwEQYDVQQDEwpkZWJtb25pdG9yMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
  -AAQBNH4qwApzKzoZpcUF5+rzNhzi2ETF1ToNoWJ4XIJH/PmYzcXmDj41+b+4p4++
  -M+ENQtHt6dfCVv0BmGr8XYTU3YUAQUiLhv/X41GLwCV4Nx5jsnpnlfyi2tfXY2b1
  -WgpdkxBTQi79fWYWJFvuy7AFhP0ahKcKfauegEHf1zJ/j7pKyjSjggEMMIIBCDAO
  -BgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU35FY
  -TrdI8tZ8bKAVj8qkrn5sp9QwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9p
  -EzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2Nv
  -dmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1Ud
  -HwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtp
  -bWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYCQXXZh0fs
  -XIlOkz1OPSSRBbEZ6zjvGEJvR6qPVpdkQ8IY+bwqe6J/wrhlAgWfTq7ODhEQYCnx
  -y9Jdg7TfybUaOnmiAkEGKMoHIi/MXfzVrKicaCo4aHIL14vN3V4go08bIsMuIs7p
  -EknA+x7QLKFunnrATNeeF6ETr+3u9/MUDWGW+fBqEw==
  ------END CERTIFICATE-----

• File[/etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft.orig
  +++ /etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft
  @@ -0,0 +1,7 @@
  +# Autogenerated by puppet
  +set LABSTORE_HOSTS_ipv4 {
  +    type ipv4_addr
  +    elements = { 208.80.154.142,
  +             208.80.154.71
  +    }
  +}

• Prometheus::Alert::Rule[check_check_cfssl-multirootca_status_52832284a5fb8b8ea6f55bb6271912c9]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_cfssl-multirootca_status_52832284a5fb8b8ea6f55bb6271912c9].orig
  +++ Prometheus::Alert::Rule[check_check_cfssl-multirootca_status_52832284a5fb8b8ea6f55bb6271912c9]
  
  -    summary            => NRPE CHECK: Check unit status of cfssl-multirootca #page
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="52832284a5fb8b8ea6f55bb6271912c9",check_name="check_check_cfssl-multirootca_status", status="CRITICAL", severity="page"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI
  -    alert_name         => nrpe_Check_unit_status_of_cfssl_multirootca
  -    instance           => ops
  -    description        => NRPE CHECK: Check unit status of cfssl-multirootca
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_cfssl-multirootca_status))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 11m
  -    group              => nrpechecks
  

• File[/etc/logrotate.d/prometheus-node-textfile-check-nft]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-check-nft].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-check-nft]
  
  +    ensure => present
  +    mode   => 0444
  +    group  => root
  +    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-check-nft.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-check-nft
  @@ -0,0 +1,12 @@
  +# logrotate(8) config for prometheus-node-textfile-check-nft
  +
  +/var/log/prometheus-node-textfile-check-nft/*.log {
  +    daily
  +    copytruncate
  +    missingok
  +    compress
  +    delaycompress
  +    notifempty
  +    rotate 15
  +    size 256M
  +}

• Service[cfssl-ocsprefresh-puppet_rsa.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-puppet_rsa.timer].orig
  +++ Service[cfssl-ocsprefresh-puppet_rsa.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_puppet_rsa" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-mlserve_front_proxy.timer]']
  -    refreshonly => True
  

• Systemd::Timer[cfssl-ocsprefresh-discovery]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-discovery].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-discovery]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-discovery.service
  

• File[/var/log/cfssl-ocsprefresh-aux_front_proxy]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-aux_front_proxy].orig
  +++ File[/var/log/cfssl-ocsprefresh-aux_front_proxy]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Class[Profile::Pki::Multirootca]

  Parameters differences:

  --- Class[Profile::Pki::Multirootca].orig
  +++ Class[Profile::Pki::Multirootca]
  
  -    enable_monitoring  => True
  -    default_expiry     => 672h
  -    default_auth_keys  => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    root_ca_cert       => profile/pki/ROOT/Wikimedia_Internal_Root_CA.pem
  -    intermediates      => {'debmonitor': {'ocsp_port': 10001}, 'discovery': {'ocsp_port': 10002, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}}, 'kafka': {'ocsp_port': 10003, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth'], 'profiles': {'kafka_11': {'expiry': '8760h'}}}, 'cloud_wmnet_ca': {'ocsp_port': 10004, 'default_usages': ['digital signature', 'key encipherment', 'server auth']}, 'etcd': {'ocsp_port': 10005, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'cassandra': {'ocsp_port': 10006, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'syslog': {'ocsp_port': 10007, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'puppet_rsa': {'ocsp_port': 10008, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'mtls': {'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'zuul': {'ocsp_port': 10009, 'default_usages': ['server auth', 'client auth']}, 'discovery2026': {'ocsp_port': 10010, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}}, 'wikikube': {'ocsp_port': 20010, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'wikikube_front_proxy': {'ocsp_port': 20011}, 'wikikube_staging': {'ocsp_port': 20020, 'default_expiry': '72h', 'profiles': {'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'wikikube_staging_front_proxy': {'ocsp_port': 20021, 'default_expiry': '72h'}, 'mlserve': {'ocsp_port': 20030, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'mlserve_front_proxy': {'ocsp_port': 20031}, 'mlserve_staging': {'ocsp_port': 20040, 'default_expiry': '72h', 'profiles': {'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'mlserve_staging_front_proxy': {'ocsp_port': 20041, 'default_expiry': '72h'}, 'aux': {'ocsp_port': 20050, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'aux_front_proxy': {'ocsp_port': 20051}, 'dse': {'ocsp_port': 20061, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'dse_front_proxy': {'ocsp_port': 20062}, 'network_devices': {'ocsp_port': 20063, 'default_expiry': '8760h', 'default_usages': ['digital signature', 'key encipherment', 'server auth']}}
  -    root_ocsp_cert     => profile/pki/ROOT/Wikimedia_Internal_Root_CA_ocsp_signing_cert.pem
  -    public_cert_base   => profile/pki/intermediates
  -    db_driver          => mysql
  -    enable_client_auth => True
  -    db_user            => pki
  -    default_profiles   => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_nets       => ['127.0.0.1/32']
  -    db_pass            => changeme
  -    maintenance_jobs   => True
  -    db_host            => m1-master.eqiad.wmnet
  -    vhost              => pki.discovery.wmnet
  -    enable_k8s_vhost   => True
  -    client_ca_source   => puppet:///modules/profile/pki/production/client_auth_CA.pem
  -    cfssl_httpd_cert   => True
  -    private_cert_base  => pki/intermediates
  -    prometheus_nodes   => ['prometheus1005.eqiad.wmnet', 'prometheus1006.eqiad.wmnet', 'prometheus1007.eqiad.wmnet', 'prometheus1008.eqiad.wmnet']
  -    db_name            => pki
  -    root_ocsp_key      => pki/ROOT/Wikimedia_Internal_Root_CA_ocsp_signing_cert.pem
  -    root_ocsp_port     => 10000
  -    root_ca_cn         => Wikimedia_Internal_Root_CA
  -    default_usages     => ['signing', 'key encipherment', 'client auth']
  

• Systemd::Syslog[cfssl-gc-expired-certs]

  Parameters differences:

  --- Systemd::Syslog[cfssl-gc-expired-certs].orig
  +++ Systemd::Syslog[cfssl-gc-expired-certs]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/var/log/cfssl-ocsprefresh-wikikube_staging]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-wikikube_staging].orig
  +++ File[/var/log/cfssl-ocsprefresh-wikikube_staging]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Cfssl::Ocsp[syslog]

  Parameters differences:

  --- Cfssl::Ocsp[syslog].orig
  +++ Cfssl::Ocsp[syslog]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/syslog/ca/syslog.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 10007
  -    db_driver          => mysql
  

• Ferm::Rule[drop-blocked-nets]

  Parameters differences:

  --- Ferm::Rule[drop-blocked-nets].orig
  +++ Ferm::Rule[drop-blocked-nets]
  
  -    ensure => present
  -    rule   => saddr $BLOCKED_NETS DROP;
  -    chain  => INPUT
  -    prio   => 01
  -    table  => filter
  -    desc   => drop abuse/blocked_nets.yaml defined in the requestctl private repo
  -    domain => (ip ip6)
  

• Systemd::Timer::Job[cfssl-ocsprefresh-network_devices]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-network_devices].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-network_devices]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - network_devices
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/network_devices/ca/network_devices.pem --responses-file /etc/cfssl/ocsp/network_devices.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@network_devices' network_devices 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Timer[cfssl-ocsprefresh-aux]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-aux].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-aux]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-aux.service
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Sudo::User[nrpe-check_check_certificate_expiry_network_devices]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_network_devices].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_network_devices]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem']
  -    tag        => nrpe::check
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Sudo::User[nrpe-check_ferm_active]

  Parameters differences:

  --- Sudo::User[nrpe-check_ferm_active].orig
  +++ Sudo::User[nrpe-check_ferm_active]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/local/lib/nagios/plugins/check_ferm']
  -    tag        => nrpe::check
  

• Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-cloud_wmnet_ca.service
  

• Cfssl::Signer[mlserve_staging]

  Parameters differences:

  --- Cfssl::Signer[mlserve_staging].orig
  +++ Cfssl::Signer[mlserve_staging]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
  -    default_expiry   => 72h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDsjCCAxOgAwIBAgIUHWrqd3I2VME7z6A5M3brKa5UlOgwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB9
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMRgwFgYDVQQDDA9tbHNlcnZlX3N0YWdpbmcwgZswEAYHKoZIzj0CAQYFK4EE
  ACMDgYYABAAu0g2dBBEAH2iUfZLPv+mA+1srb6S3bdVyH/kRk+QZDoOMnM0H8Edn
  V+dakFKXnwl+w+qsOsWj1NP2FlOm3bTglwCIxFAzX5XaDfqWa74L1tIqDH6kx+bX
  yxnuGWT/U1cv8rIHFap7ccH3h5YxPQfHy73KRTWxPln6ByswgxekotwnCKOCAQww
  ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
  BBSRzdapYuh57Gp5MstVlUJNJ+6zTzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
  g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
  ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
  SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
  L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
  AY8VuLFo6MpcfxrDG8Junk8mESfQTMRbfeZM6WpHqKYBTESkpeV8HIdTYliFDAMX
  JqE94+xbPVaTS8DZ0xiXz4SjAkIBEIIXA4nOdLYbX/MvdKWr7aDunH8n1oO3K/op
  7NktfJd5CXuECxdSonHOb7PFW5lbpCtZrLxFzhB2Hlp1TBWHX84=
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => nosecret
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/mlserve_staging
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/mlserve_staging
  -    ca_key_file      => /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages   => ['signing', 'key encipherment', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery2026]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery2026].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery2026]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• File[/lib/systemd/system/cfssl-ocspserve@kafka.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@kafka.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@kafka.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@kafka.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@kafka.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (kafka)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 10003 \
  -          -responses /etc/cfssl/ocsp/kafka.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Nrpe::Check[check_check_certificate_expiry_wikikube]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_wikikube].orig
  +++ Nrpe::Check[check_check_certificate_expiry_wikikube]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem
  -    before    => Monitoring::Service[check_certificate_expiry_wikikube]
  -    ensure    => present
  -    sudo_user => root
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-cassandra-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-cassandra-certificate-expiry --cert-path /etc/cfssl/signers/cassandra/ca/cassandra.pem --outfile /var/lib/prometheus/node.d/cassandra_intermediate.prom

• File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft].orig
  +++ File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft.orig
  +++ /etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft
  @@ -0,0 +1,14 @@
  +# Autogenerated by puppet
  +set KAFKA_BROKERS_JUMBO_ipv4 {
  +    type ipv4_addr
  +    elements = { 10.64.130.10,
  +             10.64.131.16,
  +             10.64.132.21,
  +             10.64.134.9,
  +             10.64.135.16,
  +             10.64.136.11,
  +             10.64.154.15,
  +             10.64.160.16,
  +             10.64.0.126
  +    }
  +}

• Sudo::User[nrpe_certificate_check_syslog]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_syslog].orig
  +++ Sudo::User[nrpe_certificate_check_syslog]
  
  -    user       => nrpe_certificate_check_syslog
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer
  

• Profile::Pki::Multirootca::Monitoring[cloud_wmnet_ca]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[cloud_wmnet_ca].orig
  +++ Profile::Pki::Multirootca::Monitoring[cloud_wmnet_ca]
  
  -    intermediate => cloud_wmnet_ca
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
  

• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-mlserve.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-mlserve.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-mlserve.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-mlserve.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (Wikimedia_Internal_Root_CA)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 10000 \
  -          -responses /etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_syslog]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_syslog].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_syslog]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: syslog
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_syslog!10
  

• File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (wikikube_staging_front_proxy)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 20021 \
  -          -responses /etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Package[links]

  Parameters differences:

  --- Package[links].orig
  +++ Package[links]
  
  -    provider => apt
  -    ensure   => installed
  

• File[/etc/cfssl/ocsp/wikikube_staging.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/wikikube_staging.ocsp].orig
  +++ File[/etc/cfssl/ocsp/wikikube_staging.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• File[/etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft
  @@ -0,0 +1,27 @@
  +# Autogenerated by puppet
  +set CLOUD_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 172.16.0.0/21,
  +             172.16.128.0/24,
  +             172.16.129.0/24,
  +             172.16.130.0/24,
  +             172.16.131.0/24,
  +             172.16.16.0/21,
  +             172.16.24.0/24,
  +             172.16.8.0/21,
  +             172.20.1.0/24,
  +             172.20.2.0/24,
  +             172.20.254.0/24,
  +             172.20.255.0/24,
  +             172.20.3.0/24,
  +             172.20.4.0/24,
  +             172.20.5.0/24,
  +             185.15.56.0/25,
  +             185.15.56.160/28,
  +             185.15.57.0/29,
  +             185.15.57.16/29,
  +             185.15.57.24/29
  +    }
  +}

• Logrotate::Conf[ulogd]

  Parameters differences:

  --- Logrotate::Conf[ulogd].orig
  +++ Logrotate::Conf[ulogd]
  
  -    ensure => present
  

• Exec[ensure_present_mod_ssl]

  Parameters differences:

  --- Exec[ensure_present_mod_ssl].orig
  +++ Exec[ensure_present_mod_ssl]
  
  -    command => /usr/sbin/a2enmod ssl
  -    notify  => Service[apache2]
  -    require => Package[apache2]
  -    creates => /etc/apache2/mods-enabled/ssl.load
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-aux]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-aux].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-aux]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-aux.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-aux
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-aux
  -
  -/var/log/cfssl-ocsprefresh-aux/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Systemd::Service[cfssl-ocsprefresh-cloud_wmnet_ca]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-cloud_wmnet_ca].orig
  +++ Systemd::Service[cfssl-ocsprefresh-cloud_wmnet_ca]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Logrotate::Conf[prometheus-node-textfile-check-nft]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-check-nft].orig
  +++ Logrotate::Conf[prometheus-node-textfile-check-nft]
  
  +    ensure => present
  

• File[/etc/cfssl/signers/dse]

  Parameters differences:

  --- File[/etc/cfssl/signers/dse].orig
  +++ File[/etc/cfssl/signers/dse]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-dse_front_proxy.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-dse_front_proxy.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/lib/systemd/system/cfssl-gc-expired-certs.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-gc-expired-certs.timer].orig
  +++ File[/lib/systemd/system/cfssl-gc-expired-certs.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-gc-expired-certs.timer.orig
  +++ /lib/systemd/system/cfssl-gc-expired-certs.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-gc-expired-certs.service
  -
  -[Timer]
  -Unit=cfssl-gc-expired-certs.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=hourly
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Exec[ensure_present_mod_filter]

  Parameters differences:

  --- Exec[ensure_present_mod_filter].orig
  +++ Exec[ensure_present_mod_filter]
  
  -    command => /usr/sbin/a2enmod filter
  -    notify  => Service[apache2]
  -    require => Package[apache2]
  -    creates => /etc/apache2/mods-enabled/filter.load
  

• Systemd::Unit[cfssl-ocsprefresh-zuul.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-zuul.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-zuul.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-zuul.timer
  

• Systemd::Timer::Job[cfssl-ocsprefresh-kafka]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-kafka].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-kafka]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - kafka
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/kafka/ca/kafka.pem --responses-file /etc/cfssl/ocsp/kafka.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@kafka' kafka 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_debmonitor]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_debmonitor].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_debmonitor]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_debmonitor.service
  

• Service[cfssl-ocsprefresh-mlserve_front_proxy.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-mlserve_front_proxy.timer].orig
  +++ Service[cfssl-ocsprefresh-mlserve_front_proxy.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/lib/systemd/system/cfssl-ocsprefresh-syslog.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-syslog.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-syslog.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-syslog.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-syslog.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-syslog.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-syslog.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/lib/systemd/system/cfssl-ocsprefresh-etcd.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-etcd.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-etcd.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-etcd.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-etcd.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-etcd.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-etcd.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Profile::Pki::Multirootca::Monitoring[aux]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[aux].orig
  +++ Profile::Pki::Multirootca::Monitoring[aux]
  
  -    intermediate => aux
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/aux/ca/aux.pem
  

• Service[nrpe2nodexp-check_certificate_expiry_syslog.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_syslog.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_syslog.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]']
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/usr/local/lib/nagios/plugins/check_ferm]

  Parameters differences:

  --- File[/usr/local/lib/nagios/plugins/check_ferm].orig
  +++ File[/usr/local/lib/nagios/plugins/check_ferm]
  
  -    require => File[/usr/local/lib/nagios/plugins/]
  -    ensure  => file
  -    owner   => root
  -    source  => puppet:///modules/base/firewall/check_ferm
  -    tag     => nrpe::plugin
  -    mode    => 0555
  -    group   => root
  

• Systemd::Timer[cfssl-ocsprefresh-mlserve_staging]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-mlserve_staging].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-mlserve_staging]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-mlserve_staging.service
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_puppet_rsa.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_puppet_rsa.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_puppet_rsa.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Exec[systemd daemon-reload for nftables.service (nftables)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nftables.service (nftables)].orig
  +++ Exec[systemd daemon-reload for nftables.service (nftables)]
  
  +    command     => /bin/systemctl daemon-reload
  +    before      => ['Service[nftables]']
  +    refreshonly => True
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Cfssl::Signer[etcd]

  Parameters differences:

  --- Cfssl::Signer[etcd].orig
  +++ Cfssl::Signer[etcd]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/etcd/ca/etcd.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDpzCCAwigAwIBAgIUOk3cFWirYBfYaO6q8zyqfEHxwVEwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjIwODEwMTAzODAwWhcNMjcwODA5MTAzODAwWjBy
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMQ0wCwYDVQQDEwRldGNkMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAgtdp
  7nZHIAQhEm2IlJ7AzfGjWIGGzKzCfnBQ8d+euPiOZ3ccv1YXfx0f+WmV35vuEmA/
  ZSw/6iJrKBnYsZAR6U0ByUUqg6nUYg4P47Sc/kMTWmVIgRuNhmrgavCK+qRQdnZs
  N/OOGTgFNG0icty63dUF4NZz80HxHSrPQYaNxZ9ydY2jggEMMIIBCDAOBgNVHQ8B
  Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUtvZYHyYnZHZP
  ZLIB5kqPcVOVI9owHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
  KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
  bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
  P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
  SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgEgYyeOREniK9JC
  4hvIiuv9D7mVVXzX5/s8GuhTbRadqZr41ulpHT53lFcbt+xhAsyqMxXPhgT/OyMQ
  jkXuEh5oBQJCAM22xLZpt2XwKCp0opgXlC5fm5+YjKba2COlr43q78I2la57aYdp
  UF7sFgBRFVx7FNY7CASuZMYsW+4wltPTXVau
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => ##### FAKE FOR PUPPET ######
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/etcd
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/etcd
  -    ca_key_file      => /etc/cfssl/signers/etcd/ca/etcd-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages   => ['digital signature', 'key encipherment', 'server auth', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer
  

• Systemd::Unit[cfssl-ocspserve@zuul]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@zuul].orig
  +++ Systemd::Unit[cfssl-ocspserve@zuul]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@zuul
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft].orig
  +++ File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft.orig
  +++ /etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft
  @@ -0,0 +1,12 @@
  +# Autogenerated by puppet
  +set CLOUD_NETWORKS_PUBLIC_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 185.15.56.0/25,
  +             185.15.56.160/28,
  +             185.15.57.0/29,
  +             185.15.57.16/29,
  +             185.15.57.24/29
  +    }
  +}

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Class[Firewall]

  Parameters differences:

  --- Class[Firewall].orig
  +++ Class[Firewall]
  
  @@
  -    provider => ferm
  +    provider => nftables
  

• Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-wikikube_staging_front_proxy.service
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/cfssl/signers/debmonitor]

  Parameters differences:

  --- File[/etc/cfssl/signers/debmonitor].orig
  +++ File[/etc/cfssl/signers/debmonitor]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cassandra -profile ocsp /etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Systemd::Service[cfssl-ocspserve@mlserve_staging]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@mlserve_staging].orig
  +++ Systemd::Service[cfssl-ocspserve@mlserve_staging]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/cfssl/ocsp/discovery2026.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/discovery2026.ocsp].orig
  +++ File[/etc/cfssl/ocsp/discovery2026.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Profile::Auto_restarts::Service[apache2]

  Parameters differences:

  --- Profile::Auto_restarts::Service[apache2].orig
  +++ Profile::Auto_restarts::Service[apache2]
  
  -    ensure => present
  

• File[/srv/cfssl/bundles/discovery.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/discovery.pem].orig
  +++ File[/srv/cfssl/bundles/discovery.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/discovery.pem.orig
  +++ /srv/cfssl/bundles/discovery.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDrDCCAw2gAwIBAgIUcVMxEVtp5xErDjx/jInOFcUaRjkwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjEwNTA0MTM1NDAwWhcNMjYwNTAzMTM1NDAwWjB3
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRIwEAYDVQQDEwlkaXNjb3ZlcnkwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
  -BAG7X6lQ05D8EQYwPd+v2qT12Y35j/YQTaOEbAuKQJBshTdMizCxGe4GUB33Nivw
  -3B0o9EcyCQokcUCUGtVlI3U0QQArB+LuehDTw7D5JKwOUK5GpSG5YlNL7Kg2c3gI
  -wyck1+Z5yDMIsclW5FtaM1IIFeUIOXrulmih3zM4PPrVtP3Vh6OCAQwwggEIMA4G
  -A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSJ76Rw
  -5IjvCdxrdGkh4PHUL7PCBjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
  -NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
  -ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
  -BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
  -ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAeamwKAw
  -q+lKC/GdcPuP2SOoyij0+LFWucrQwxxiCiXlMAhSnj3fkKk5G5pLoFnY2X7hB0w4
  -ZPtLXG7If9pmIDjwAkIBwnJUYLz3dJTbZudeUJFX4yD49liKTYMPDpl/HWKSh9m4
  -4PZKXsAIs4CT29jwwtmsLK1HkPB0ShO8Egm/KB5dLUs=
  ------END CERTIFICATE-----

• File[/var/log/cfssl-ocsprefresh-etcd]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-etcd].orig
  +++ File[/var/log/cfssl-ocsprefresh-etcd]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Service[cfssl-ocsprefresh-cassandra.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-cassandra.timer].orig
  +++ Service[cfssl-ocsprefresh-cassandra.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-debmonitor" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-debmonitor/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
  
  -    ensure => present
  

• Cfssl::Config[aux_front_proxy]

  Parameters differences:

  --- Cfssl::Config[aux_front_proxy].orig
  +++ Cfssl::Config[aux_front_proxy]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/aux_front_proxy/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/aux_front_proxy
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/aux_front_proxy
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages      => ['signing', 'key encipherment', 'client auth']
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_front_proxy.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_front_proxy.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_front_proxy.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Systemd::Unit[cfssl-ocspserve@etcd]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@etcd].orig
  +++ Systemd::Unit[cfssl-ocspserve@etcd]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@etcd
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-wikikube_front_proxy
  -
  -/var/log/cfssl-ocsprefresh-wikikube_front_proxy/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_discovery.service
  

• File[/etc/ferm/ferm.conf]

  Parameters differences:

  --- File[/etc/ferm/ferm.conf].orig
  +++ File[/etc/ferm/ferm.conf]
  
  -    notify  => Service[ferm]
  -    require => Package[ferm]
  -    ensure  => file
  -    owner   => root
  -    source  => puppet:///modules/ferm/ferm.conf
  -    mode    => 0400
  -    group   => root
  

• Nrpe::Monitor_service[check_certificate_expiry_wikikube_front_proxy]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_wikikube_front_proxy].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_wikikube_front_proxy]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: wikikube_front_proxy
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
  -    timeout                     => 10
  

• File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca].orig
  +++ File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Exec[Generate initial CRL for aux_front_proxy]

  Parameters differences:

  --- Exec[Generate initial CRL for aux_front_proxy].orig
  +++ Exec[Generate initial CRL for aux_front_proxy]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/aux_front_proxy
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/aux_front_proxy
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• Exec[Generate initial CRL for dse_front_proxy]

  Parameters differences:

  --- Exec[Generate initial CRL for dse_front_proxy].orig
  +++ Exec[Generate initial CRL for dse_front_proxy]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/dse_front_proxy
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/dse_front_proxy
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-wikikube_staging-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (mlserve_front_proxy)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 20031 \
  -          -responses /etc/cfssl/ocsp/mlserve_front_proxy.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft.orig
  +++ /etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft
  @@ -0,0 +1,191 @@
  +# Autogenerated by puppet
  +set LOAD_BALANCER_HEALTH_CHECKS_ipv4 {
  +    type ipv4_addr
  +    elements = { 10.64.0.136,
  +             10.64.16.60,
  +             10.64.158.19,
  +             10.64.166.19,
  +             10.64.133.19,
  +             10.64.141.19,
  +             10.64.169.19,
  +             10.64.171.19,
  +             10.64.173.19,
  +             10.64.175.19,
  +             10.64.177.19,
  +             10.64.179.19,
  +             10.64.181.19,
  +             10.64.183.19,
  +             10.64.185.19,
  +             10.64.187.19,
  +             10.64.189.19,
  +             10.64.48.72,
  +             10.64.37.17,
  +             10.64.1.17,
  +             10.64.17.17,
  +             10.64.33.17,
  +             10.64.130.20,
  +             10.64.131.20,
  +             10.64.132.20,
  +             10.64.134.20,
  +             10.64.135.20,
  +             10.64.136.20,
  +             10.64.158.20,
  +             10.64.166.20,
  +             10.64.133.20,
  +             10.64.141.20,
  +             10.64.169.20,
  +             10.64.171.20,
  +             10.64.173.20,
  +             10.64.175.20,
  +             10.64.177.20,
  +             10.64.179.20,
  +             10.64.181.20,
  +             10.64.183.20,
  +             10.64.185.20,
  +             10.64.187.20,
  +             10.64.189.20,
  +             10.192.23.8,
  +             10.192.0.29,
  +             10.192.17.8,
  +             10.192.33.8,
  +             10.192.49.8,
  +             10.192.23.2,
  +             10.192.5.2,
  +             10.192.6.2,
  +             10.192.7.2,
  +             10.192.8.2,
  +             10.192.9.2,
  +             10.192.10.2,
  +             10.192.11.2,
  +             10.192.12.2,
  +             10.192.13.2,
  +             10.192.14.2,
  +             10.192.15.2,
  +             10.192.21.2,
  +             10.192.22.2,
  +             10.192.4.2,
  +             10.192.26.2,
  +             10.192.27.2,
  +             10.192.28.2,
  +             10.192.29.2,
  +             10.192.30.2,
  +             10.192.31.2,
  +             10.192.36.2,
  +             10.192.37.2,
  +             10.192.38.2,
  +             10.192.39.2,
  +             10.192.40.2,
  +             10.192.41.2,
  +             10.192.42.2,
  +             10.192.43.2,
  +             10.192.11.8,
  +             10.192.16.140,
  +             10.192.1.8,
  +             10.192.33.9,
  +             10.192.49.9,
  +             10.192.23.3,
  +             10.192.5.3,
  +             10.192.6.3,
  +             10.192.7.3,
  +             10.192.8.3,
  +             10.192.9.3,
  +             10.192.10.3,
  +             10.192.11.3,
  +             10.192.12.3,
  +             10.192.13.3,
  +             10.192.14.3,
  +             10.192.15.3,
  +             10.192.21.3,
  +             10.192.22.3,
  +             10.192.4.3,
  +             10.192.26.3,
  +             10.192.27.3,
  +             10.192.28.3,
  +             10.192.29.3,
  +             10.192.30.3,
  +             10.192.31.3,
  +             10.192.36.3,
  +             10.192.37.3,
  +             10.192.38.3,
  +             10.192.39.4,
  +             10.192.40.3,
  +             10.192.41.3,
  +             10.192.42.3,
  +             10.192.43.3,
  +             10.192.32.14,
  +             10.192.1.9,
  +             10.192.17.9,
  +             10.192.49.10,
  +             10.192.23.4,
  +             10.192.5.4,
  +             10.192.6.4,
  +             10.192.7.4,
  +             10.192.8.4,
  +             10.192.9.4,
  +             10.192.10.4,
  +             10.192.11.4,
  +             10.192.12.4,
  +             10.192.13.4,
  +             10.192.14.4,
  +             10.192.15.4,
  +             10.192.21.4,
  +             10.192.22.4,
  +             10.192.4.5,
  +             10.192.26.5,
  +             10.192.27.5,
  +             10.192.28.5,
  +             10.192.29.5,
  +             10.192.30.5,
  +             10.192.31.5,
  +             10.192.36.5,
  +             10.192.37.5,
  +             10.192.38.5,
  +             10.192.39.6,
  +             10.192.40.5,
  +             10.192.41.5,
  +             10.192.42.5,
  +             10.192.43.5,
  +             10.192.48.213,
  +             10.192.1.13,
  +             10.192.17.10,
  +             10.192.33.10,
  +             10.192.23.5,
  +             10.192.5.8,
  +             10.192.6.5,
  +             10.192.7.5,
  +             10.192.8.5,
  +             10.192.9.5,
  +             10.192.10.5,
  +             10.192.11.5,
  +             10.192.12.5,
  +             10.192.13.5,
  +             10.192.14.5,
  +             10.192.15.5,
  +             10.192.21.5,
  +             10.192.22.5,
  +             10.80.0.3,
  +             10.80.1.8,
  +             10.80.1.14,
  +             10.80.0.9,
  +             10.80.0.2,
  +             10.80.1.10,
  +             10.128.0.18,
  +             10.128.0.9,
  +             10.128.0.11,
  +             10.132.0.39,
  +             10.132.0.6,
  +             10.132.0.7,
  +             10.136.0.16,
  +             10.136.1.19,
  +             10.136.1.15,
  +             10.136.0.19,
  +             10.136.0.17,
  +             10.136.1.20,
  +             10.140.0.13,
  +             10.140.1.2,
  +             10.140.1.14,
  +             10.140.0.2,
  +             10.140.0.14,
  +             10.140.1.3
  +    }
  +}

• Systemd::Syslog[wmf_auto_restart_apache2]

  Parameters differences:

  --- Systemd::Syslog[wmf_auto_restart_apache2].orig
  +++ Systemd::Syslog[wmf_auto_restart_apache2]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@cloud_wmnet_ca]']
  -    refreshonly => True
  

• File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Systemd::Timer::Job[cfssl-ocsprefresh-zuul]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-zuul].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-zuul]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - zuul
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/zuul/ca/zuul.pem --responses-file /etc/cfssl/ocsp/zuul.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@zuul' zuul 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/cfssl/signers/mlserve_staging_front_proxy]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_staging_front_proxy].orig
  +++ File[/etc/cfssl/signers/mlserve_staging_front_proxy]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging_front_proxy]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging_front_proxy].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging_front_proxy]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• File[/etc/cfssl/signers/kafka/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/kafka/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/kafka/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/kafka/cfssl.conf.orig
  +++ /etc/cfssl/signers/kafka/cfssl.conf
  @@ -1,75 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "digital signature",
  -        "key encipherment",
  -        "server auth",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/kafka",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/kafka"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "kafka_11": {
  -        "auth_key": "default_auth",
  -        "expiry": "8760h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth",
  -          "client auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Nftables::Set[DOMAIN_NETWORKS]

  Parameters differences:

  --- Nftables::Set[DOMAIN_NETWORKS].orig
  +++ Nftables::Set[DOMAIN_NETWORKS]
  
  +    hosts  => ['10.128.0.0/24', '10.128.1.0/24', '10.128.2.0/24', '10.132.0.0/24', '10.132.2.0/24', '10.136.0.0/24', '10.136.1.0/24', '10.140.0.0/24', '10.140.1.0/24', '10.140.2.0/24', '10.192.0.0/22', '10.192.10.0/24', '10.192.11.0/24', '10.192.12.0/24', '10.192.13.0/24', '10.192.14.0/24', '10.192.15.0/24', '10.192.16.0/22', '10.192.20.0/24', '10.192.21.0/24', '10.192.22.0/24', '10.192.23.0/24', '10.192.24.0/23', '10.192.26.0/24', '10.192.27.0/24', '10.192.28.0/24', '10.192.29.0/24', '10.192.30.0/24', '10.192.31.0/24', '10.192.32.0/22', '10.192.36.0/24', '10.192.37.0/24', '10.192.38.0/24', '10.192.39.0/24', '10.192.4.0/24', '10.192.40.0/24', '10.192.41.0/24', '10.192.42.0/24', '10.192.43.0/24', '10.192.44.0/24', '10.192.45.0/24', '10.192.46.0/24', '10.192.47.0/24', '10.192.48.0/22', '10.192.5.0/24', '10.192.52.0/24', '10.192.56.0/24', '10.192.57.0/24', '10.192.58.0/24', '10.192.59.0/24', '10.192.6.0/24', '10.192.64.0/21', '10.192.7.0/24', '10.192.72.0/24', '10.192.76.0/24', '10.192.8.0/24', '10.192.80.0/20', '10.192.9.0/24', '10.192.96.0/21', '10.194.0.0/20', '10.194.128.0/17', '10.194.16.0/21', '10.194.61.0/24', '10.194.62.0/23', '10.194.64.0/20', '10.194.80.0/21', '10.2.1.0/24', '10.2.2.0/24', '10.2.3.0/24', '10.2.4.0/24', '10.2.5.0/24', '10.2.6.0/24', '10.2.7.0/24', '10.64.0.0/22', '10.64.130.0/24', '10.64.131.0/24', '10.64.132.0/24', '10.64.133.0/24', '10.64.134.0/24', '10.64.135.0/24', '10.64.136.0/24', '10.64.137.0/24', '10.64.138.0/24', '10.64.139.0/24', '10.64.140.0/24', '10.64.141.0/24', '10.64.142.0/24', '10.64.143.0/24', '10.64.144.0/24', '10.64.145.0/24', '10.64.148.0/24', '10.64.149.0/24', '10.64.150.0/24', '10.64.151.0/24', '10.64.152.0/24', '10.64.153.0/24', '10.64.154.0/24', '10.64.155.0/24', '10.64.156.0/24', '10.64.157.0/24', '10.64.158.0/24', '10.64.159.0/24', '10.64.16.0/22', '10.64.160.0/24', '10.64.161.0/24', '10.64.162.0/24', '10.64.163.0/24', '10.64.164.0/24', '10.64.165.0/24', '10.64.166.0/24', '10.64.167.0/24', '10.64.169.0/24', '10.64.170.0/24', '10.64.171.0/24', '10.64.172.0/24', '10.64.173.0/24', '10.64.174.0/24', '10.64.175.0/24', '10.64.176.0/24', '10.64.177.0/24', '10.64.178.0/24', '10.64.179.0/24', '10.64.180.0/24', '10.64.181.0/24', '10.64.182.0/24', '10.64.183.0/24', '10.64.184.0/24', '10.64.185.0/24', '10.64.186.0/24', '10.64.187.0/24', '10.64.188.0/24', '10.64.189.0/24', '10.64.190.0/24', '10.64.20.0/24', '10.64.21.0/24', '10.64.24.0/23', '10.64.32.0/22', '10.64.36.0/24', '10.64.48.0/22', '10.64.5.0/24', '10.64.53.0/24', '10.64.64.0/21', '10.64.72.0/24', '10.64.76.0/24', '10.67.0.0/20', '10.67.128.0/17', '10.67.16.0/21', '10.67.24.0/21', '10.67.32.0/20', '10.67.64.0/20', '10.67.80.0/21', '10.80.0.0/24', '10.80.1.0/24', '10.80.2.0/24', '103.102.166.0/28', '103.102.166.224/27', '103.102.166.96/27', '185.15.58.0/27', '185.15.58.224/27', '185.15.58.32/27', '185.15.59.0/27', '185.15.59.224/27', '185.15.59.32/27', '185.15.59.96/27', '195.200.68.0/27', '195.200.68.224/27', '195.200.68.32/27', '195.200.68.96/27', '198.35.26.0/27', '198.35.26.32/27', '198.35.26.96/27', '198.35.26.96/27', '2001:df2:e500:101::/64', '2001:df2:e500:103::/64', '2001:df2:e500:1::/64', '2001:df2:e500:3::/64', '2001:df2:e500:ed1a::/64', '208.80.152.128/27', '208.80.153.0/27', '208.80.153.224/27', '208.80.153.32/27', '208.80.153.64/27', '208.80.153.96/27', '208.80.154.0/26', '208.80.154.128/26', '208.80.154.224/27', '208.80.154.64/26', '208.80.155.96/27', '2620:0:860:100::/64', '2620:0:860:101::/64', '2620:0:860:102::/64', '2620:0:860:103::/64', '2620:0:860:104::/64', '2620:0:860:105::/64', '2620:0:860:106::/64', '2620:0:860:107::/64', '2620:0:860:108::/64', '2620:0:860:109::/64', '2620:0:860:10a::/64', '2620:0:860:10b::/64', '2620:0:860:10c::/64', '2620:0:860:10d::/64', '2620:0:860:10e::/64', '2620:0:860:10f::/64', '2620:0:860:110::/64', '2620:0:860:111::/64', '2620:0:860:112::/64', '2620:0:860:113::/64', '2620:0:860:114::/64', '2620:0:860:115::/64', '2620:0:860:116::/64', '2620:0:860:118::/64', '2620:0:860:119::/64', '2620:0:860:11a::/64', '2620:0:860:11b::/64', '2620:0:860:11c::/64', '2620:0:860:11d::/64', '2620:0:860:11e::/64', '2620:0:860:11f::/64', '2620:0:860:120::/64', '2620:0:860:121::/64', '2620:0:860:122::/64', '2620:0:860:123::/64', '2620:0:860:124::/64', '2620:0:860:125::/64', '2620:0:860:126::/64', '2620:0:860:127::/64', '2620:0:860:12b::/64', '2620:0:860:12c::/64', '2620:0:860:12d::/64', '2620:0:860:12e::/64', '2620:0:860:140::/64', '2620:0:860:1::/64', '2620:0:860:2::/64', '2620:0:860:300::/64', '2620:0:860:301::/64', '2620:0:860:302::/64', '2620:0:860:303::/64', '2620:0:860:304::/64', '2620:0:860:305::/64', '2620:0:860:307::/64', '2620:0:860:308::/64', '2620:0:860:3::/64', '2620:0:860:4::/64', '2620:0:860:5::/64', '2620:0:860:babe::/64', '2620:0:860:babf::/64', '2620:0:860:cabe::/64', '2620:0:860:cabf::/64', '2620:0:860:ed1a::/64', '2620:0:861:100::/64', '2620:0:861:101::/64', '2620:0:861:102::/64', '2620:0:861:103::/64', '2620:0:861:104::/64', '2620:0:861:105::/64', '2620:0:861:106::/64', '2620:0:861:107::/64', '2620:0:861:108::/64', '2620:0:861:109::/64', '2620:0:861:10a::/64', '2620:0:861:10b::/64', '2620:0:861:10c::/64', '2620:0:861:10d::/64', '2620:0:861:10e::/64', '2620:0:861:10f::/64', '2620:0:861:110::/64', '2620:0:861:111::/64', '2620:0:861:112::/64', '2620:0:861:113::/64', '2620:0:861:114::/64', '2620:0:861:115::/64', '2620:0:861:116::/64', '2620:0:861:117::/64', '2620:0:861:118::/64', '2620:0:861:119::/64', '2620:0:861:11a::/64', '2620:0:861:11c::/64', '2620:0:861:11d::/64', '2620:0:861:11e::/64', '2620:0:861:11f::/64', '2620:0:861:120::/64', '2620:0:861:121::/64', '2620:0:861:122::/64', '2620:0:861:123::/64', '2620:0:861:124::/64', '2620:0:861:125::/64', '2620:0:861:126::/64', '2620:0:861:127::/64', '2620:0:861:128::/64', '2620:0:861:129::/64', '2620:0:861:12a::/64', '2620:0:861:12b::/64', '2620:0:861:12c::/64', '2620:0:861:12d::/64', '2620:0:861:12e::/64', '2620:0:861:12f::/64', '2620:0:861:131::/64', '2620:0:861:132::/64', '2620:0:861:133::/64', '2620:0:861:134::/64', '2620:0:861:135::/64', '2620:0:861:136::/64', '2620:0:861:137::/64', '2620:0:861:138::/64', '2620:0:861:139::/64', '2620:0:861:13a::/64', '2620:0:861:13b::/64', '2620:0:861:13c::/64', '2620:0:861:13d::/64', '2620:0:861:13e::/64', '2620:0:861:13f::/64', '2620:0:861:140::/64', '2620:0:861:141::/64', '2620:0:861:142::/64', '2620:0:861:143::/64', '2620:0:861:144::/64', '2620:0:861:145::/64', '2620:0:861:1::/64', '2620:0:861:2::/64', '2620:0:861:300::/64', '2620:0:861:301::/116', '2620:0:861:302::/64', '2620:0:861:303::/116', '2620:0:861:304::/116', '2620:0:861:305::/64', '2620:0:861:3::/64', '2620:0:861:4::/64', '2620:0:861:babe::/64', '2620:0:861:babf::/116', '2620:0:861:cabe::/64', '2620:0:861:cabf::/116', '2620:0:861:ed1a::/64', '2620:0:863:101::/64', '2620:0:863:102::/64', '2620:0:863:103::/64', '2620:0:863:1::/64', '2620:0:863:2::/64', '2620:0:863:3::/64', '2620:0:863:ed1a::/64', '2a02:ec80:300:101::/64', '2a02:ec80:300:102::/64', '2a02:ec80:300:103::/64', '2a02:ec80:300:1::/64', '2a02:ec80:300:2::/64', '2a02:ec80:300:3::/64', '2a02:ec80:300:ed1a::/64', '2a02:ec80:600:101::/64', '2a02:ec80:600:102::/64', '2a02:ec80:600:1::/64', '2a02:ec80:600:2::/64', '2a02:ec80:600:ed1a::/64', '2a02:ec80:700:101::/64', '2a02:ec80:700:102::/64', '2a02:ec80:700:103::/64', '2a02:ec80:700:1::/64', '2a02:ec80:700:2::/64', '2a02:ec80:700:3::/64', '2a02:ec80:700:ed1a::/64']
  +    ensure => present
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_debmonitor_224e2ac3574a9ce482218106d95a2931]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_debmonitor_224e2ac3574a9ce482218106d95a2931].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_debmonitor_224e2ac3574a9ce482218106d95a2931]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: debmonitor
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="224e2ac3574a9ce482218106d95a2931",check_name="check_check_certificate_expiry_debmonitor", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__debmonitor
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: debmonitor
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_debmonitor))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer
  

• Service[nrpe2nodexp-check_cfssl-multirootca_status.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_cfssl-multirootca_status.timer].orig
  +++ Service[nrpe2nodexp-check_cfssl-multirootca_status.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]']
  

• Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Systemd::Unit[nrpe2nodexp-ferm_active.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-ferm_active.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-ferm_active.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-ferm_active.timer
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]']
  -    refreshonly => True
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/lib/systemd/system/cfssl-ocspserve@wikikube.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@wikikube.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@wikikube.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@wikikube.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@wikikube.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (wikikube)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 20010 \
  -          -responses /etc/cfssl/ocsp/wikikube.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Cfssl::Cert[OCSP_mlserve_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_mlserve_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_mlserve_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => mlserve
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@mlserve]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-mlserve]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• Systemd::Service[cfssl-ocspserve@etcd]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@etcd].orig
  +++ Systemd::Service[cfssl-ocspserve@etcd]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki.discovery.wmnet
  -    hosts       => ['pki1001.eqiad.wmnet']
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem].orig
  +++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem]
  
  -    require => Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]
  -    ensure  => file
  -    group   => root
  -    owner   => root
  

• Systemd::Service[cfssl-ocsprefresh-wikikube_staging_front_proxy]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
  +++ Systemd::Service[cfssl-ocsprefresh-wikikube_staging_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-mlserve-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-mlserve-certificate-expiry --cert-path /etc/cfssl/signers/mlserve/ca/mlserve.pem --outfile /var/lib/prometheus/node.d/mlserve_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/var/log/wmf_auto_restart_ulogd2]

  Parameters differences:

  --- File[/var/log/wmf_auto_restart_ulogd2].orig
  +++ File[/var/log/wmf_auto_restart_ulogd2]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@wikikube_staging.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@wikikube_staging.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (wikikube_staging)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 20020 \
  -          -responses /etc/cfssl/ocsp/wikikube_staging.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft
  @@ -0,0 +1,8 @@
  +# Autogenerated by puppet
  +set MLSTAGE_KUBEPODS_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2620:0:860:302::/64
  +    }
  +}

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_mlserve.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_mlserve.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_puppet_rsa command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_puppet_rsa
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "c1b324b3d8ac107f8d7483b4017f5edf" --timeout 10 --check-command "check_check_certificate_expiry_puppet_rsa"

• Nftables::Set[INTERNAL]

  Parameters differences:

  --- Nftables::Set[INTERNAL].orig
  +++ Nftables::Set[INTERNAL]
  
  +    hosts  => ['10.0.0.0/8', '2620:0:860:100::/56', '2620:0:861:100::/56', '2620:0:863:100::/56', '2a02:ec80:300:100::/56', '2a02:ec80:600:100::/56', '2a02:ec80:700:100::/56', '2001:df2:e500:100::/56', '2a02:ec80:ff00:100::/56']
  +    ensure => present
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_dse.service
  

• File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - mlserve_staging_front_proxy
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --responses-file /etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_staging_front_proxy' mlserve_staging_front_proxy 

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "d2a76a31e44e204e2d4788a2698d0e6c" --timeout 10 --check-command "check_check_certificate_expiry_wikikube"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_wikikube
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Systemd::Unit[cfssl-gc-expired-certs.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-gc-expired-certs.service].orig
  +++ Systemd::Unit[cfssl-gc-expired-certs.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-gc-expired-certs.service
  

• File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-mlserve_staging.timer
  

• Nrpe::Check[check_check_certificate_expiry_network_devices]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_network_devices].orig
  +++ Nrpe::Check[check_check_certificate_expiry_network_devices]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem
  -    before    => Monitoring::Service[check_certificate_expiry_network_devices]
  -    ensure    => present
  -    sudo_user => root
  

• Logrotate::Conf[cfssl-ocsprefresh-discovery2026]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-discovery2026].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-discovery2026]
  
  -    ensure => present
  

• File[/usr/local/bin/prometheus-check-discovery-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-discovery-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-discovery-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Exec[Generate initial CRL for mlserve_staging]

  Parameters differences:

  --- Exec[Generate initial CRL for mlserve_staging].orig
  +++ Exec[Generate initial CRL for mlserve_staging]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/mlserve_staging
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/mlserve_staging
  

• File[/etc/nftables/sets/INSTALL_HOSTS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/INSTALL_HOSTS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/INSTALL_HOSTS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/INSTALL_HOSTS_ipv4.nft.orig
  +++ /etc/nftables/sets/INSTALL_HOSTS_ipv4.nft
  @@ -0,0 +1,12 @@
  +# Autogenerated by puppet
  +set INSTALL_HOSTS_ipv4 {
  +    type ipv4_addr
  +    elements = { 208.80.154.134,
  +             208.80.153.70,
  +             185.15.59.101,
  +             198.35.26.98,
  +             103.102.166.11,
  +             185.15.58.7,
  +             195.200.68.100
  +    }
  +}

• File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft
  @@ -0,0 +1,9 @@
  +# Autogenerated by puppet
  +set WIKIKUBE_KUBEPODS_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 10.67.128.0/17,
  +             10.194.128.0/17
  +    }
  +}

• File[/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem].orig
  +++ File[/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem.orig
  +++ /etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem
  @@ -1 +0,0 @@
  -##### FAKE FOR PUPPET ######

• Profile::Pki::Multirootca::Monitoring[mlserve]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[mlserve].orig
  +++ Profile::Pki::Multirootca::Monitoring[mlserve]
  
  -    intermediate => mlserve
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/mlserve/ca/mlserve.pem
  

• Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-mlserve_staging.service
  

• Prometheus::Node_textfile[prometheus-check-debmonitor-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-debmonitor-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-debmonitor-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-debmonitor-certificate-expiry --cert-path /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --outfile /var/lib/prometheus/node.d/debmonitor_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Cfssl::Cert[OCSP_zuul_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_zuul_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_zuul_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => zuul
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@zuul]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-zuul]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy].orig
  +++ Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_wikikube_staging_front_proxy!10
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: wikikube_staging
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_wikikube_staging!10
  

• Logrotate::Conf[cfssl-ocsprefresh-kafka]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-kafka].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-kafka]
  
  -    ensure => present
  

• Service[nrpe2nodexp-check_certificate_expiry_mlserve.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_mlserve.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_mlserve.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]']
  

• Sudo::User[nrpe-check_check_certificate_expiry_aux]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_aux].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_aux]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem']
  -    tag        => nrpe::check
  

• Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.timer (nrpe2nodexp-ferm_active.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.timer (nrpe2nodexp-ferm_active.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.timer (nrpe2nodexp-ferm_active.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[nrpe2nodexp-ferm_active.timer]']
  -    refreshonly => True
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_debmonitor.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_debmonitor.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• Cfssl::Cert[OCSP_wikikube_staging_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_wikikube_staging_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_wikikube_staging_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => wikikube_staging
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@wikikube_staging]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf]
  
  +    notify => Service[rsyslog]
  +    ensure => present
  +    owner  => root
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf
  @@ -0,0 +1,10 @@
  +# rsyslog.conf(5) configuration file for services.
  +# This file is managed by Puppet.
  +if $programname startswith "prometheus-node-textfile-check-nft" then {
  +    action(
  +        type="omfile" file="/var/log/prometheus-node-textfile-check-nft/syslog.log"
  +        fileOwner="root" fileGroup="root"
  +        fileCreateMode="0644"
  +    )
  +    & stop
  +}

• File[/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf.orig
  +++ /etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf
  @@ -1,64 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "signing",
  -        "key encipherment",
  -        "client auth"
  -      ],
  -      "expiry": "72h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/mlserve_staging_front_proxy",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/mlserve_staging_front_proxy"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Systemd::Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Service[cfssl-ocsprefresh-mlserve_staging.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-mlserve_staging.timer].orig
  +++ Service[cfssl-ocsprefresh-mlserve_staging.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/apache2/conf-enabled]

  Parameters differences:

  --- File[/etc/apache2/conf-enabled].orig
  +++ File[/etc/apache2/conf-enabled]
  
  -    notify  => Service[apache2]
  -    ensure  => directory
  -    recurse => True
  -    purge   => True
  -    mode    => 0755
  -    require => Package[apache2]
  -    owner   => root
  -    group   => root
  

• Cfssl::Cert[OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_dse_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => dse_front_proxy
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@dse_front_proxy]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• File[/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_kafka]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_kafka].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_kafka]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_kafka.service
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_syslog.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_syslog.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_syslog.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Systemd::Timer[cfssl-ocsprefresh-debmonitor]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-debmonitor].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-debmonitor]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-debmonitor.service
  

• Service[nrpe2nodexp-check_certificate_expiry_kafka.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_kafka.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_kafka.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]']
  

• Sudo::User[nrpe-check_check_certificate_expiry_etcd]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_etcd].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_etcd]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem']
  -    tag        => nrpe::check
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Cfssl::Cert[OCSP_discovery2026_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_discovery2026_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_discovery2026_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => discovery2026
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@discovery2026]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Exec[ensure_present_mod_proxy_http]

  Parameters differences:

  --- Exec[ensure_present_mod_proxy_http].orig
  +++ Exec[ensure_present_mod_proxy_http]
  
  -    command => /usr/sbin/a2enmod proxy_http
  -    notify  => Service[apache2]
  -    require => Package[apache2]
  -    creates => /etc/apache2/mods-enabled/proxy_http.load
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_wikikube]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem

• Systemd::Service[cfssl-ocsprefresh-syslog]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-syslog].orig
  +++ Systemd::Service[cfssl-ocsprefresh-syslog]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-syslog.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Syslog[cfssl-ocsprefresh-mlserve_front_proxy]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-mlserve_front_proxy].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-mlserve_front_proxy]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_syslog.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_syslog.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
  
  -    ensure => present
  

• Service[cfssl-ocspserve@mlserve]

  Parameters differences:

  --- Service[cfssl-ocspserve@mlserve].orig
  +++ Service[cfssl-ocspserve@mlserve]
  
  -    ensure => running
  -    enable => True
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve -profile ocsp /etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_syslog_e3b9b989d5062ce2d267023dfe42fcd8]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_syslog_e3b9b989d5062ce2d267023dfe42fcd8].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_syslog_e3b9b989d5062ce2d267023dfe42fcd8]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: syslog
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="e3b9b989d5062ce2d267023dfe42fcd8",check_name="check_check_certificate_expiry_syslog", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__syslog
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: syslog
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_syslog))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• File[/etc/cfssl/signers/etcd]

  Parameters differences:

  --- File[/etc/cfssl/signers/etcd].orig
  +++ File[/etc/cfssl/signers/etcd]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Nftables::Set[CLOUD_PRIVATE_NETWORKS]

  Parameters differences:

  --- Nftables::Set[CLOUD_PRIVATE_NETWORKS].orig
  +++ Nftables::Set[CLOUD_PRIVATE_NETWORKS]
  
  +    hosts  => ['172.20.1.0/24', '172.20.2.0/24', '172.20.3.0/24', '172.20.4.0/24', '2a02:ec80:a000:201::/64', '2a02:ec80:a000:202::/64', '2a02:ec80:a000:203::/64', '2a02:ec80:a000:204::/64', '172.20.5.0/24', '2a02:ec80:a100:205::/64']
  +    ensure => present
  

• Monitoring::Exported_nagios_service[pki1001 ferm_active]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 ferm_active].orig
  +++ Monitoring::Exported_nagios_service[pki1001 ferm_active]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/Monitoring/check_ferm
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 30
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check whether ferm is active by checking the default input chain
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_ferm_active!10
  

• Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• File[/var/log/ulogd]

  Parameters differences:

  --- File[/var/log/ulogd].orig
  +++ File[/var/log/ulogd]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging_front_proxy]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging_front_proxy].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging_front_proxy]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_mlserve_staging_front_proxy!10
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_front_proxy command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "4d759acaf0fd7dd3abaa03dc4565aef6" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_front_proxy"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Exec[unmask_nftables.service]

  Parameters differences:

  --- Exec[unmask_nftables.service].orig
  +++ Exec[unmask_nftables.service]
  
  +    command     => /bin/systemctl unmask nftables.service
  +    refreshonly => False
  +    onlyif      => /bin/readlink -f /etc/systemd/system/nftables.service | grep -q /dev/null
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/lib/systemd/system/cfssl-ocsprefresh-kafka.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-kafka.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-kafka.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-kafka.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-kafka.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-kafka.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-kafka.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Exec[Generate initial CRL for cloud_wmnet_ca]

  Parameters differences:

  --- Exec[Generate initial CRL for cloud_wmnet_ca].orig
  +++ Exec[Generate initial CRL for cloud_wmnet_ca]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/cloud_wmnet_ca
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/cloud_wmnet_ca
  

• Systemd::Unit[apache2-apache2-after-network-online-target]

  Parameters differences:

  --- Systemd::Unit[apache2-apache2-after-network-online-target].orig
  +++ Systemd::Unit[apache2-apache2-after-network-online-target]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => apache2-after-network-online-target
  -    ensure            => absent
  -    override          => True
  -    restart           => False
  -    unit              => apache2
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Systemd::Unit[cfssl-ocsprefresh-syslog.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-syslog.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-syslog.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-syslog.timer
  

• Class[Profile::Base::Production]

  Parameters differences:

  --- Class[Profile::Base::Production].orig
  +++ Class[Profile::Base::Production]
  
  @@
  -    role_description => PKI server
  +    role_description => Host being setup by Infrastructure Foundations SREs with ntables
  

• Nftables::Set[MYSQL_ROOT_CLIENTS]

  Parameters differences:

  --- Nftables::Set[MYSQL_ROOT_CLIENTS].orig
  +++ Nftables::Set[MYSQL_ROOT_CLIENTS]
  
  +    hosts  => ['10.64.16.90', '10.192.16.191', '10.64.16.154', '10.192.32.49', '208.80.155.103', '208.80.154.9', '10.64.0.20']
  +    ensure => present
  

• File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• File[/etc/nftables/sets/NETWORK_INFRA_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/NETWORK_INFRA_ipv4.nft].orig
  +++ File[/etc/nftables/sets/NETWORK_INFRA_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/NETWORK_INFRA_ipv4.nft.orig
  +++ /etc/nftables/sets/NETWORK_INFRA_ipv4.nft
  @@ -0,0 +1,19 @@
  +# Autogenerated by puppet
  +set NETWORK_INFRA_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 185.15.59.128/27,
  +             198.35.26.128/27,
  +             208.80.153.192/27,
  +             10.192.255.0/24,
  +             10.192.253.0/24,
  +             208.80.154.192/27,
  +             10.64.146.0/24,
  +             10.64.168.0/24,
  +             10.64.147.0/24,
  +             103.102.166.128/27,
  +             185.15.58.128/27,
  +             195.200.68.128/27
  +    }
  +}

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: dse
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_dse!10
  

• File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft.orig
  +++ /etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft
  @@ -0,0 +1,7 @@
  +# Autogenerated by puppet
  +set DEPLOYMENT_HOSTS_ipv4 {
  +    type ipv4_addr
  +    elements = { 10.64.16.93,
  +             10.192.32.7
  +    }
  +}

• File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer]

  Parameters differences:

  --- File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer].orig
  +++ File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer]
  
  -    notify => Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer.orig
  +++ /lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of wmf_auto_restart_apache-htcacheclean.service
  -
  -[Timer]
  -Unit=wmf_auto_restart_apache-htcacheclean.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 3:51:00
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Monitoring::Service[check_certificate_expiry_aux]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_aux].orig
  +++ Monitoring::Service[check_certificate_expiry_aux]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: aux
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_aux!10
  

• File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft.orig
  +++ /etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft
  @@ -0,0 +1,7 @@
  +# Autogenerated by puppet
  +set KAFKAMON_HOSTS_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:103:10:64:32:11,
  +             2620:0:860:102:10:192:16:139
  +    }
  +}

• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
  

• Sudo::User[nrpe-check_check_certificate_expiry_syslog]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_syslog].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_syslog]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem']
  -    tag        => nrpe::check
  

• Rsyslog::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-debmonitor]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-debmonitor].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-debmonitor]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-debmonitor.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-debmonitor
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-debmonitor
  -
  -/var/log/cfssl-ocsprefresh-debmonitor/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Cfssl::Cert[OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => wikikube_front_proxy
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@wikikube_front_proxy]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_mlserve_staging_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem

• Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
  

• File[/etc/cfssl/signers/zuul/ca/zuul.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/zuul/ca/zuul.pem].orig
  +++ File[/etc/cfssl/signers/zuul/ca/zuul.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/zuul/ca/zuul.pem.orig
  +++ /etc/cfssl/signers/zuul/ca/zuul.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDpzCCAwigAwIBAgIUMIxkteGnxVGRNFWjJZ+eXPnOeM8wCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjUwODIwMTg1NTAwWhcNMzAwODE5MTg1NTAwWjBy
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMQ0wCwYDVQQDEwR6dXVsMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBNx/m
  -dSpc4EWI68Y36PVvDkvyqlJ6pA4sEXQCrNOM+0jSACRM8Shwqr7uC/JmuP8GIdK3
  -g+SgxQOjF9pfelX2OpAB6leOfgHXhFtzJquX261tKsxQm74cszycF9YTiWDKVq0V
  -g7bFNgf4NcC7NxGfN4SuA58I7dQWJxSWdzTJNQsF2uijggEMMIIBCDAOBgNVHQ8B
  -Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUqyQEoVfbsJqL
  -jr5RyZovCpWdRZUwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
  -KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
  -bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
  -P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
  -SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgER9R3mwAtzYcIh
  -HAnL2SiHTXBpqitQp6Ce+7nYFP0qyu+Ggkx2bu86bl32lGmvA6ecTKXDiyXW5pMW
  -atmKn0wAegJCAaU9pfWuLIgsVqzB2zvDWMR2HgBMa6MO7dRlG2VUoLvR16NF9cln
  -XjNzIqPRxUpiD5TNC4+p9BoT+RRXEDUeRufH
  ------END CERTIFICATE-----

• Monitoring::Service[check_certificate_expiry_network_devices]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_network_devices].orig
  +++ Monitoring::Service[check_certificate_expiry_network_devices]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: network_devices
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_network_devices!10
  

• Nftables::Set[MLSERVE_KUBEPODS_NETWORKS]

  Parameters differences:

  --- Nftables::Set[MLSERVE_KUBEPODS_NETWORKS].orig
  +++ Nftables::Set[MLSERVE_KUBEPODS_NETWORKS]
  
  +    hosts  => ['10.67.16.0/21', '2620:0:861:300::/64', '10.194.16.0/21', '2620:0:860:300::/64']
  +    ensure => present
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-mlserve_staging_front_proxy
  -
  -/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/sudoers.d/nrpe_certificate_check_dse]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_dse].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_dse]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft
  @@ -0,0 +1,183 @@
  +# Autogenerated by puppet
  +set DOMAIN_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2001:df2:e500:101::/64,
  +             2001:df2:e500:103::/64,
  +             2001:df2:e500:1::/64,
  +             2001:df2:e500:3::/64,
  +             2001:df2:e500:ed1a::/64,
  +             2620:0:860:100::/64,
  +             2620:0:860:101::/64,
  +             2620:0:860:102::/64,
  +             2620:0:860:103::/64,
  +             2620:0:860:104::/64,
  +             2620:0:860:105::/64,
  +             2620:0:860:106::/64,
  +             2620:0:860:107::/64,
  +             2620:0:860:108::/64,
  +             2620:0:860:109::/64,
  +             2620:0:860:10a::/64,
  +             2620:0:860:10b::/64,
  +             2620:0:860:10c::/64,
  +             2620:0:860:10d::/64,
  +             2620:0:860:10e::/64,
  +             2620:0:860:10f::/64,
  +             2620:0:860:110::/64,
  +             2620:0:860:111::/64,
  +             2620:0:860:112::/64,
  +             2620:0:860:113::/64,
  +             2620:0:860:114::/64,
  +             2620:0:860:115::/64,
  +             2620:0:860:116::/64,
  +             2620:0:860:118::/64,
  +             2620:0:860:119::/64,
  +             2620:0:860:11a::/64,
  +             2620:0:860:11b::/64,
  +             2620:0:860:11c::/64,
  +             2620:0:860:11d::/64,
  +             2620:0:860:11e::/64,
  +             2620:0:860:11f::/64,
  +             2620:0:860:120::/64,
  +             2620:0:860:121::/64,
  +             2620:0:860:122::/64,
  +             2620:0:860:123::/64,
  +             2620:0:860:124::/64,
  +             2620:0:860:125::/64,
  +             2620:0:860:126::/64,
  +             2620:0:860:127::/64,
  +             2620:0:860:12b::/64,
  +             2620:0:860:12c::/64,
  +             2620:0:860:12d::/64,
  +             2620:0:860:12e::/64,
  +             2620:0:860:140::/64,
  +             2620:0:860:1::/64,
  +             2620:0:860:2::/64,
  +             2620:0:860:300::/64,
  +             2620:0:860:301::/64,
  +             2620:0:860:302::/64,
  +             2620:0:860:303::/64,
  +             2620:0:860:304::/64,
  +             2620:0:860:305::/64,
  +             2620:0:860:307::/64,
  +             2620:0:860:308::/64,
  +             2620:0:860:3::/64,
  +             2620:0:860:4::/64,
  +             2620:0:860:5::/64,
  +             2620:0:860:babe::/64,
  +             2620:0:860:babf::/64,
  +             2620:0:860:cabe::/64,
  +             2620:0:860:cabf::/64,
  +             2620:0:860:ed1a::/64,
  +             2620:0:861:100::/64,
  +             2620:0:861:101::/64,
  +             2620:0:861:102::/64,
  +             2620:0:861:103::/64,
  +             2620:0:861:104::/64,
  +             2620:0:861:105::/64,
  +             2620:0:861:106::/64,
  +             2620:0:861:107::/64,
  +             2620:0:861:108::/64,
  +             2620:0:861:109::/64,
  +             2620:0:861:10a::/64,
  +             2620:0:861:10b::/64,
  +             2620:0:861:10c::/64,
  +             2620:0:861:10d::/64,
  +             2620:0:861:10e::/64,
  +             2620:0:861:10f::/64,
  +             2620:0:861:110::/64,
  +             2620:0:861:111::/64,
  +             2620:0:861:112::/64,
  +             2620:0:861:113::/64,
  +             2620:0:861:114::/64,
  +             2620:0:861:115::/64,
  +             2620:0:861:116::/64,
  +             2620:0:861:117::/64,
  +             2620:0:861:118::/64,
  +             2620:0:861:119::/64,
  +             2620:0:861:11a::/64,
  +             2620:0:861:11c::/64,
  +             2620:0:861:11d::/64,
  +             2620:0:861:11e::/64,
  +             2620:0:861:11f::/64,
  +             2620:0:861:120::/64,
  +             2620:0:861:121::/64,
  +             2620:0:861:122::/64,
  +             2620:0:861:123::/64,
  +             2620:0:861:124::/64,
  +             2620:0:861:125::/64,
  +             2620:0:861:126::/64,
  +             2620:0:861:127::/64,
  +             2620:0:861:128::/64,
  +             2620:0:861:129::/64,
  +             2620:0:861:12a::/64,
  +             2620:0:861:12b::/64,
  +             2620:0:861:12c::/64,
  +             2620:0:861:12d::/64,
  +             2620:0:861:12e::/64,
  +             2620:0:861:12f::/64,
  +             2620:0:861:131::/64,
  +             2620:0:861:132::/64,
  +             2620:0:861:133::/64,
  +             2620:0:861:134::/64,
  +             2620:0:861:135::/64,
  +             2620:0:861:136::/64,
  +             2620:0:861:137::/64,
  +             2620:0:861:138::/64,
  +             2620:0:861:139::/64,
  +             2620:0:861:13a::/64,
  +             2620:0:861:13b::/64,
  +             2620:0:861:13c::/64,
  +             2620:0:861:13d::/64,
  +             2620:0:861:13e::/64,
  +             2620:0:861:13f::/64,
  +             2620:0:861:140::/64,
  +             2620:0:861:141::/64,
  +             2620:0:861:142::/64,
  +             2620:0:861:143::/64,
  +             2620:0:861:144::/64,
  +             2620:0:861:145::/64,
  +             2620:0:861:1::/64,
  +             2620:0:861:2::/64,
  +             2620:0:861:300::/64,
  +             2620:0:861:301::/116,
  +             2620:0:861:302::/64,
  +             2620:0:861:303::/116,
  +             2620:0:861:304::/116,
  +             2620:0:861:305::/64,
  +             2620:0:861:3::/64,
  +             2620:0:861:4::/64,
  +             2620:0:861:babe::/64,
  +             2620:0:861:babf::/116,
  +             2620:0:861:cabe::/64,
  +             2620:0:861:cabf::/116,
  +             2620:0:861:ed1a::/64,
  +             2620:0:863:101::/64,
  +             2620:0:863:102::/64,
  +             2620:0:863:103::/64,
  +             2620:0:863:1::/64,
  +             2620:0:863:2::/64,
  +             2620:0:863:3::/64,
  +             2620:0:863:ed1a::/64,
  +             2a02:ec80:300:101::/64,
  +             2a02:ec80:300:102::/64,
  +             2a02:ec80:300:103::/64,
  +             2a02:ec80:300:1::/64,
  +             2a02:ec80:300:2::/64,
  +             2a02:ec80:300:3::/64,
  +             2a02:ec80:300:ed1a::/64,
  +             2a02:ec80:600:101::/64,
  +             2a02:ec80:600:102::/64,
  +             2a02:ec80:600:1::/64,
  +             2a02:ec80:600:2::/64,
  +             2a02:ec80:600:ed1a::/64,
  +             2a02:ec80:700:101::/64,
  +             2a02:ec80:700:102::/64,
  +             2a02:ec80:700:103::/64,
  +             2a02:ec80:700:1::/64,
  +             2a02:ec80:700:2::/64,
  +             2a02:ec80:700:3::/64,
  +             2a02:ec80:700:ed1a::/64
  +    }
  +}

• File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem

• Cfssl::Signer[dse_front_proxy]

  Parameters differences:

  --- Cfssl::Signer[dse_front_proxy].orig
  +++ Cfssl::Signer[dse_front_proxy]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDsjCCAxOgAwIBAgIUBGeKXglKnoXGyRgWodaHSfz0z/gwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjB9
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMRgwFgYDVQQDDA9kc2VfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
  ACMDgYYABAGUNx07sN1MWk3DzjEFh3pfYaQVrqo1tWFQjf7URfwqfyZY81Tqt6yl
  y/zj3DpvtOmvyI5jPH91yPBaFho0/SpP6wFkBIyE8/Ik2b80slPKuzstrYgBlYsG
  +Fxop4CYWjLItOy1Ut82aYr76hNm0goEma9ETjgE4nfBEU3vi77QO/B9E6OCAQww
  ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
  BBQPHxMmkuy8EqO+Wz7TmM1MfmcXDDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
  g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
  ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
  SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
  L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
  AO3JNb9OyC3JQ3mmkgt+Db3NMgLArYlvcYd8Nd5uWEXm6d6NfUPDN5XBGkjly1B7
  N18vKQYxlZzX2wgYqaK9LYs9AkIBch3vTND/M2T78Hhp5YoodasCdLDcpMJ1Qn3T
  fI0Lwjt7W50T0FMle6CwZkI+ZrxRzqvic19IUSTDDqwiOFgLhqM=
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => 
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/dse_front_proxy
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/dse_front_proxy
  -    ca_key_file      => /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages   => ['signing', 'key encipherment', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube -profile ocsp /etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Cfssl::Config[wikikube]

  Parameters differences:

  --- Cfssl::Config[wikikube].orig
  +++ Cfssl::Config[wikikube]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/wikikube/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/wikikube
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/wikikube
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages      => ['signing', 'key encipherment', 'client auth']
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
  

• Systemd::Unit[cfssl-ocsprefresh-aux.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-aux.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-aux.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-aux.timer
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-dse-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-dse-certificate-expiry --cert-path /etc/cfssl/signers/dse/ca/dse.pem --outfile /var/lib/prometheus/node.d/dse_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/cfssl/ocsp/kafka.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/kafka.ocsp].orig
  +++ File[/etc/cfssl/ocsp/kafka.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• File[/etc/modules-load.d/conntrack.conf]

  Parameters differences:

  --- File[/etc/modules-load.d/conntrack.conf].orig
  +++ File[/etc/modules-load.d/conntrack.conf]
  
  @@
  -    ensure => file
  +    ensure => absent
  

• Exec[Generate initial CRL for mlserve_staging_front_proxy]

  Parameters differences:

  --- Exec[Generate initial CRL for mlserve_staging_front_proxy].orig
  +++ Exec[Generate initial CRL for mlserve_staging_front_proxy]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/mlserve_staging_front_proxy
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/mlserve_staging_front_proxy
  

• File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Rsyslog::Conf[cfssl-ocsprefresh-discovery2026]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-discovery2026].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-discovery2026]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-discovery2026]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-dse]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-dse].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-dse]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-dse.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-dse
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-dse
  -
  -/var/log/cfssl-ocsprefresh-dse/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/cfssl/signers/puppet_rsa/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/puppet_rsa/ca].orig
  +++ File[/etc/cfssl/signers/puppet_rsa/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Profile::Pki::Multirootca::Monitoring[wikikube_staging]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[wikikube_staging].orig
  +++ Profile::Pki::Multirootca::Monitoring[wikikube_staging]
  
  -    intermediate => wikikube_staging
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
  

• File[/etc/cfssl/signers/etcd/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/etcd/ca].orig
  +++ File[/etc/cfssl/signers/etcd/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• File[/var/log/wmf_auto_restart_apache2]

  Parameters differences:

  --- File[/var/log/wmf_auto_restart_apache2].orig
  +++ File[/var/log/wmf_auto_restart_apache2]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Cfssl::Cert[OCSP_network_devices_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_network_devices_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_network_devices_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => network_devices
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@network_devices]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-network_devices]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-aux-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Monitoring::Service[check_certificate_expiry_mlserve_front_proxy]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_mlserve_front_proxy].orig
  +++ Monitoring::Service[check_certificate_expiry_mlserve_front_proxy]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: mlserve_front_proxy
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_mlserve_front_proxy!10
  

• File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]

  Parameters differences:

  --- File[/usr/local/lib/nagios/plugins/check_systemd_unit_status].orig
  +++ File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]
  
  -    require => File[/usr/local/lib/nagios/plugins/]
  -    ensure  => file
  -    owner   => root
  -    source  => puppet:///modules/systemd/check_systemd_unit_status
  -    tag     => nrpe::plugin
  -    mode    => 0555
  -    group   => root
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_front_proxy command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "4d759acaf0fd7dd3abaa03dc4565aef6" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_front_proxy"

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Prometheus::Node_textfile[prometheus-check-aux_front_proxy-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-aux_front_proxy-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-aux_front_proxy-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --outfile /var/lib/prometheus/node.d/aux_front_proxy_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-mlserve_staging_front_proxy-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_front_proxy_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Unit[cfssl-ocspserve@syslog]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@syslog].orig
  +++ Systemd::Unit[cfssl-ocspserve@syslog]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@syslog
  

• Cfssl::Signer[puppet_rsa]

  Parameters differences:

  --- Cfssl::Signer[puppet_rsa].orig
  +++ Cfssl::Signer[puppet_rsa]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIFNDCCBJagAwIBAgIUOR+ZAFtrzLKYphDIGMa9eF6O0LIwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjIwMTIwNTAwWhcNMjgwNjE4MTIwNTAwWjB4
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMRMwEQYDVQQDDApwdXBwZXRfcnNhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
  MIICCgKCAgEA4urK5Og7RVGoXg6KzYywzaXyRROuj0Kauc7n/BgCWvsKv9Ll4f/p
  lbVGOSln3akzhBlJwmVTGrgCmWQVxMF2agKAR+R1aV2Wc+yEfofUbW1oRgBCelMQ
  Xutw0cApO+lzjHNtduffeIEVBjwLcEG/OdaUa2CGFGLG/dHox7o8AZgkH7SFJyby
  z/rzip+szHpMThhjs0PKx91VS1srb7Q1jE1OlB7ydhX+gLRWTjwxOp1ITFXjNobk
  i16jcP3YYgCvj8qwWMcYmtI7iExSeFdptv3fmajBeoi1o52LUWKUrslwtNa/emaB
  FBGRZfu8ap+BWWpYYarI4mOCyvetw/6FZ2LnuWy5cNA3GoALB5xfLpO3twYnrveP
  BnxULp4Q8szITB/bjPBMkd8FG8Frpe3eZNKNHG9xjJGdS1Bxhq7Zgfy09V1RJCym
  AJSWERHRrxjEnRCDd7HUAhfaDCygeooe4wGRR5bG8WqOpkQDtYPP3yfk5NBhcJpW
  mXTRFTFkuslEL/2bwa9EPIOAKAINDeJOCHqJMQd6EXwTP2LabWU3oI+sfeBdCoSd
  Rn+q2Z0kSLu8fqXsgPgvdgyWjfPkQnyLAz9rdsal2x4x9SilDkov+l6Q9DXGGoYO
  GGOHHFCFhM9CS02zFGLe1JbqiHPuYuIkEnGjGJyCqdIB8Rz0JxdypEcCAwEAAaOC
  AQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1Ud
  DgQWBBRrq/ZHBKl8OZGQrQCiUq4GRc86YDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yA
  vzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9w
  a2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3Rf
  Q0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQv
  Y3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCB
  hwJBJHrjuBvyK8Sv40xCW/TrVtOCIVaXfjwsKau9lkmt/6purO/xkppZDMajueYw
  9koKhj6SvliOpiwgypfOKP7nbsACQgFAnawARDYCoOQ8pQDoqpRkPBBScMOTMPFu
  xTekxW2V7POn9dn6uavLJz/wha+sNgAnYT4wHWkRJzbUk+1H3Hb3NA==
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => nosecret
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/puppet_rsa
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/puppet_rsa
  -    ca_key_file      => /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'mtls': {'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages   => ['digital signature', 'key encipherment', 'server auth']
  -    serve_service    => cfssl-multirootca
  

• Systemd::Service[cfssl-ocsprefresh-zuul]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-zuul].orig
  +++ Systemd::Service[cfssl-ocsprefresh-zuul]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-zuul.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Cfssl::Signer[network_devices]

  Parameters differences:

  --- Cfssl::Signer[network_devices].orig
  +++ Cfssl::Signer[network_devices]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/network_devices/ca/network_devices.pem
  -    default_expiry   => 8760h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDsjCCAxOgAwIBAgIUS2pUBD1erPOX2W9m08l4NjcjbVYwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNzE0MTAxODAwWhcNMjgwNzEyMTAxODAwWjB9
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMRgwFgYDVQQDDA9uZXR3b3JrX2RldmljZXMwgZswEAYHKoZIzj0CAQYFK4EE
  ACMDgYYABABVWARjDjpjG7IlggP4BkOm5hanZXdtYYzUb1CsmHvpBA4W6s8CjzHp
  QlZoBzaMi6SSO5Q7v9rAuymjLctweVRy7gAkNU3jjQXZPjRKaW/ofZlUhDyhgyCS
  WNr9LBjYklAnMM3yz3J6EG9aHehHbV11lq24AQDrZ4bEtNzGHMQyU9ufZ6OCAQww
  ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
  BBRmY7aPPiOyhsjgXpDtumx9X/wcGzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
  g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
  ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
  SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
  L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
  ARWhtt4Mi0I8j+6LUC+ZJfTnhYkEWSXa6nhttbzNPLzHuBTnj42WE8a2oQW2Mv5w
  mzRdtJGsstcrgGwGt5FyLP6WAkIAxYlEt4MHqohD9adWY1IsnX4qWBYRw4tXrx0T
  tF1M2n2K7ww/zCL9HkBoWVe249y+ctpGqqgw0ROMnMN6Q2Zg8ic=
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => fake key
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/network_devices
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/network_devices
  -    ca_key_file      => /etc/cfssl/signers/network_devices/ca/network_devices-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages   => ['digital signature', 'key encipherment', 'server auth']
  -    serve_service    => cfssl-multirootca
  

• Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Systemd::Unit[cfssl-gc-expired-certs.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-gc-expired-certs.timer].orig
  +++ Systemd::Unit[cfssl-gc-expired-certs.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-gc-expired-certs.timer
  

• Exec[Generate initial CRL for zuul]

  Parameters differences:

  --- Exec[Generate initial CRL for zuul].orig
  +++ Exec[Generate initial CRL for zuul]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/zuul/ca/zuul.pem /etc/cfssl/signers/zuul/ca/zuul-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/zuul
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/zuul
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)].orig
  +++ Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Service[cfssl-ocsprefresh-wikikube_front_proxy.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-wikikube_front_proxy.timer].orig
  +++ Service[cfssl-ocsprefresh-wikikube_front_proxy.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Rsyslog::Conf[cfssl-ocsprefresh-mlserve]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-mlserve].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-mlserve]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-mlserve]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/cfssl/signers/wikikube/ca/wikikube.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube/ca/wikikube.pem].orig
  +++ File[/etc/cfssl/signers/wikikube/ca/wikikube.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/wikikube/ca/wikikube.pem.orig
  +++ /etc/cfssl/signers/wikikube/ca/wikikube.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDqzCCAwygAwIBAgIUWXrkQs5GEdgVcV7/XAEZOXQLYlowCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB2
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMREwDwYDVQQDEwh3aWtpa3ViZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAE
  -AX4fMTh3NrBZlCMop5eKr6F/RXTefrSSdu6DE39OOKTTdYM3TxK8tPmTDm9EE+XT
  -4rO+VHuaIVVirgB2JQtla8oZAZb60Pw8v9BlJ1JLLK9vpWA9Vce7DKmMNxIWK9GA
  -YIUQufjHVD2eibYJsK54NGkBe3frhPhwayIvzJ3gGO34GRaRo4IBDDCCAQgwDgYD
  -VR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFAaU1Sae
  -B9+FDd+SrIADU8yIo+xJMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2
  -MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zl
  -cnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8E
  -QzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1l
  -ZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBFZVjRbh3
  -GaouRaz9IPef3q+9s+TleKGby7nJQ6z71M3rpJIsHr9lncr/9GPq5v5cHDYOHmgK
  -GBupTY7FNMwL8aACQgCgoDP6PO23Dw6tuswLIbeY+o5l3K8R5L3RS1DO59OXXV2f
  -9FmoJNLgGXgP87rOkFW1fn9/QcvX85zD0urkq8gNjg==
  ------END CERTIFICATE-----

• Service[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_discovery2026.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]']
  

• Service[cfssl-ocspserve@zuul]

  Parameters differences:

  --- Service[cfssl-ocspserve@zuul].orig
  +++ Service[cfssl-ocspserve@zuul]
  
  -    ensure => running
  -    enable => True
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@mlserve]']
  -    refreshonly => True
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_mlserve_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/lib/systemd/system/cfssl-ocsprefresh-kafka.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-kafka.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-kafka.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-kafka.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-kafka.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - kafka
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/kafka/ca/kafka.pem --responses-file /etc/cfssl/ocsp/kafka.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@kafka' kafka 

• Systemd::Timer[cfssl-ocsprefresh-cassandra]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-cassandra].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-cassandra]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-cassandra.service
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_debmonitor]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_debmonitor].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_debmonitor]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: debmonitor
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_debmonitor!10
  

• Service[cfssl-ocspserve@puppet_rsa]

  Parameters differences:

  --- Service[cfssl-ocspserve@puppet_rsa].orig
  +++ Service[cfssl-ocspserve@puppet_rsa]
  
  -    ensure => running
  -    enable => True
  

• Rsyslog::Conf[ulogd]

  Parameters differences:

  --- Rsyslog::Conf[ulogd].orig
  +++ Rsyslog::Conf[ulogd]
  
  -    priority => 40
  -    require  => File[/var/log/ulogd]
  -    ensure   => present
  -    mode     => 0444
  

• Exec[Generate initial CRL for discovery]

  Parameters differences:

  --- Exec[Generate initial CRL for discovery].orig
  +++ Exec[Generate initial CRL for discovery]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/discovery/ca/discovery.pem /etc/cfssl/signers/discovery/ca/discovery-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/discovery
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/discovery
  

• Ferm::Rule[filter_log_filter-bootp]

  Parameters differences:

  --- Ferm::Rule[filter_log_filter-bootp].orig
  +++ Ferm::Rule[filter_log_filter-bootp]
  
  -    ensure => present
  -    rule   => proto udp  daddr 255.255.255.255 sport 67 dport 68 DROP;
  -    chain  => INPUT
  -    prio   => 98
  -    table  => filter
  -    desc   => 
  -    domain => (ip ip6)
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging_front_proxy]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging_front_proxy]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_puppet_rsa_c1b324b3d8ac107f8d7483b4017f5edf]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_puppet_rsa_c1b324b3d8ac107f8d7483b4017f5edf].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_puppet_rsa_c1b324b3d8ac107f8d7483b4017f5edf]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: puppet_rsa
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="c1b324b3d8ac107f8d7483b4017f5edf",check_name="check_check_certificate_expiry_puppet_rsa", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__puppet_rsa
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: puppet_rsa
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_puppet_rsa))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_etcd_c834f873297e445663ead81279c0b928]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_etcd_c834f873297e445663ead81279c0b928].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_etcd_c834f873297e445663ead81279c0b928]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: etcd
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="c834f873297e445663ead81279c0b928",check_name="check_check_certificate_expiry_etcd", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__etcd
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: etcd
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_etcd))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Logrotate::Conf[cfssl-ocsprefresh-network_devices]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-network_devices].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-network_devices]
  
  -    ensure => present
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/usr/local/bin/prometheus-check-mlserve-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-mlserve-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-mlserve-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Systemd::Syslog[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]']
  

• Monitoring::Service[check_certificate_expiry_discovery2026]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_discovery2026].orig
  +++ Monitoring::Service[check_certificate_expiry_discovery2026]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: discovery2026
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_discovery2026!10
  

• File[/var/lib/prometheus/node.d/check_check_cfssl-multirootca_status.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_cfssl-multirootca_status.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_cfssl-multirootca_status.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Cfssl::Signer[cloud_wmnet_ca]

  Parameters differences:

  --- Cfssl::Signer[cloud_wmnet_ca].orig
  +++ Cfssl::Signer[cloud_wmnet_ca]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDrzCCAxKgAwIBAgIURAaLNJ85iLqv3Tqt4ylu7Dhe0o0wCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjExMjEzMTg1NTAwWhcNMjYxMjEyMTg1NTAwWjB8
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMRcwFQYDVQQDDA5jbG91ZF93bW5ldF9jYTCBmzAQBgcqhkjOPQIBBgUrgQQA
  IwOBhgAEAFsH4mfZKGu87WTpX9yabGE0+vO4UBQaN/IUGnjmscZTZ7761iAwuZcs
  33yjwzoX2W+R0IwAPJbagtB92uYPmA6eAUDV4WAuOml+AqAP0elVtW7i+T/Bm4qc
  SrlGCDsALgJ765YZCDS9OmzAm9rXbQXFmsxqrm9I3aPXIOWIww5+Zg1mo4IBDDCC
  AQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
  FMavCWJlEuGLgOx5zgBdQCQ0Zxj7MB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGD
  kdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5k
  aXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBK
  BgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwv
  V2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYoAMIGGAkEQ
  XFKpUB99oxOp7uK3GztZblTr8DECjcwbJOXYfZLGyfzzNIKPMGPkBGNmGkP7Ie1G
  RSCNRsI1VR8/geUR0YUrpwJBRZWF4DZM3cga+6VB7pEv/7r/pQERs/ivzckNwDLi
  /LK1pbHc/MeNOdoy7TouLf1djsw40VYtGNT7/9FldHoWqsA=
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => fake
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/cloud_wmnet_ca
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/cloud_wmnet_ca
  -    ca_key_file      => /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages   => ['digital signature', 'key encipherment', 'server auth']
  -    serve_service    => cfssl-multirootca
  

• Sudo::User[nrpe-check_check_certificate_expiry_cassandra]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_cassandra].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_cassandra]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem']
  -    tag        => nrpe::check
  

• Rsyslog::Conf[cfssl-ocsprefresh-cassandra]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-cassandra].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-cassandra]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-cassandra]
  -    ensure   => present
  -    mode     => 0444
  

• Nftables::Set[CLOUD_NETWORKS_PUBLIC]

  Parameters differences:

  --- Nftables::Set[CLOUD_NETWORKS_PUBLIC].orig
  +++ Nftables::Set[CLOUD_NETWORKS_PUBLIC]
  
  +    hosts  => ['185.15.56.0/25', '185.15.56.160/28', '185.15.57.0/29', '185.15.57.16/29', '185.15.57.24/29', '2a02:ec80:a000:4000::/64', '2a02:ec80:a100:4000::/64']
  +    ensure => present
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/signers/cassandra/ca/cassandra-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/cassandra/ca/cassandra-key.pem].orig
  +++ File[/etc/cfssl/signers/cassandra/ca/cassandra-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/cassandra/ca/cassandra-key.pem.orig
  +++ /etc/cfssl/signers/cassandra/ca/cassandra-key.pem
  @@ -1 +0,0 @@
  -nosecret

• Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_aux.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_aux
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem

• Nftables::Set[MW_APPSERVER_NETWORKS]

  Parameters differences:

  --- Nftables::Set[MW_APPSERVER_NETWORKS].orig
  +++ Nftables::Set[MW_APPSERVER_NETWORKS]
  
  +    hosts  => ['10.64.0.0/22', '10.64.130.0/24', '10.64.131.0/24', '10.64.132.0/24', '10.64.133.0/24', '10.64.134.0/24', '10.64.135.0/24', '10.64.136.0/24', '10.64.141.0/24', '10.64.152.0/24', '10.64.154.0/24', '10.64.156.0/24', '10.64.158.0/24', '10.64.16.0/22', '10.64.160.0/24', '10.64.162.0/24', '10.64.164.0/24', '10.64.166.0/24', '10.64.169.0/24', '10.64.171.0/24', '10.64.173.0/24', '10.64.175.0/24', '10.64.177.0/24', '10.64.179.0/24', '10.64.181.0/24', '10.64.183.0/24', '10.64.185.0/24', '10.64.187.0/24', '10.64.189.0/24', '10.64.32.0/22', '10.64.48.0/22', '2620:0:861:101::/64', '2620:0:861:102::/64', '2620:0:861:103::/64', '2620:0:861:107::/64', '2620:0:861:109::/64', '2620:0:861:10a::/64', '2620:0:861:10b::/64', '2620:0:861:10c::/64', '2620:0:861:10d::/64', '2620:0:861:10e::/64', '2620:0:861:10f::/64', '2620:0:861:113::/64', '2620:0:861:119::/64', '2620:0:861:120::/64', '2620:0:861:122::/64', '2620:0:861:124::/64', '2620:0:861:126::/64', '2620:0:861:128::/64', '2620:0:861:12a::/64', '2620:0:861:12c::/64', '2620:0:861:12e::/64', '2620:0:861:131::/64', '2620:0:861:133::/64', '2620:0:861:135::/64', '2620:0:861:137::/64', '2620:0:861:139::/64', '2620:0:861:13b::/64', '2620:0:861:13d::/64', '2620:0:861:13f::/64', '2620:0:861:142::/64', '2620:0:861:144::/64', '10.192.0.0/22', '10.192.10.0/24', '10.192.11.0/24', '10.192.12.0/24', '10.192.13.0/24', '10.192.14.0/24', '10.192.15.0/24', '10.192.16.0/22', '10.192.21.0/24', '10.192.22.0/24', '10.192.23.0/24', '10.192.26.0/24', '10.192.27.0/24', '10.192.28.0/24', '10.192.29.0/24', '10.192.30.0/24', '10.192.31.0/24', '10.192.32.0/22', '10.192.36.0/24', '10.192.37.0/24', '10.192.38.0/24', '10.192.39.0/24', '10.192.4.0/24', '10.192.40.0/24', '10.192.41.0/24', '10.192.42.0/24', '10.192.43.0/24', '10.192.44.0/24', '10.192.45.0/24', '10.192.46.0/24', '10.192.47.0/24', '10.192.48.0/22', '10.192.5.0/24', '10.192.52.0/24', '10.192.56.0/24', '10.192.57.0/24', '10.192.58.0/24', '10.192.59.0/24', '10.192.6.0/24', '10.192.7.0/24', '10.192.8.0/24', '10.192.9.0/24', '2620:0:860:100::/64', '2620:0:860:101::/64', '2620:0:860:102::/64', '2620:0:860:103::/64', '2620:0:860:104::/64', '2620:0:860:105::/64', '2620:0:860:106::/64', '2620:0:860:107::/64', '2620:0:860:108::/64', '2620:0:860:109::/64', '2620:0:860:10a::/64', '2620:0:860:10b::/64', '2620:0:860:10c::/64', '2620:0:860:10d::/64', '2620:0:860:10e::/64', '2620:0:860:10f::/64', '2620:0:860:110::/64', '2620:0:860:111::/64', '2620:0:860:112::/64', '2620:0:860:113::/64', '2620:0:860:114::/64', '2620:0:860:115::/64', '2620:0:860:116::/64', '2620:0:860:119::/64', '2620:0:860:11a::/64', '2620:0:860:11b::/64', '2620:0:860:11c::/64', '2620:0:860:11d::/64', '2620:0:860:11e::/64', '2620:0:860:11f::/64', '2620:0:860:120::/64', '2620:0:860:121::/64', '2620:0:860:122::/64', '2620:0:860:123::/64', '2620:0:860:124::/64', '2620:0:860:125::/64', '2620:0:860:126::/64', '2620:0:860:127::/64', '2620:0:860:12b::/64', '2620:0:860:12c::/64', '2620:0:860:12d::/64', '2620:0:860:12e::/64', '10.192.64.0/21', '10.192.96.0/21', '10.194.128.0/17', '10.194.16.0/21', '10.194.61.0/24', '10.194.80.0/21', '10.64.64.0/21', '10.67.128.0/17', '10.67.16.0/21', '10.67.24.0/21', '10.67.80.0/21', '2620:0:860:300::/64', '2620:0:860:302::/64', '2620:0:860:305::/64', '2620:0:860:308::/64', '2620:0:860:babe::/64', '2620:0:860:cabe::/64', '2620:0:861:300::/64', '2620:0:861:302::/64', '2620:0:861:305::/64', '2620:0:861:babe::/64', '2620:0:861:cabe::/64', '208.80.154.0/26', '208.80.154.128/26', '208.80.154.64/26', '208.80.155.96/27', '2620:0:861:1::/64', '2620:0:861:2::/64', '2620:0:861:3::/64', '2620:0:861:4::/64', '208.80.153.0/27', '208.80.153.32/27', '208.80.153.64/27', '208.80.153.96/27', '2620:0:860:1::/64', '2620:0:860:2::/64', '2620:0:860:3::/64', '2620:0:860:4::/64']
  +    ensure => present
  

• Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]']
  

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
  
  -    ensure => present
  

• Cfssl::Cert[OCSP_etcd_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_etcd_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_etcd_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => etcd
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@etcd]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-etcd]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• File[/var/log/prometheus-node-textfile-check-nft]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-check-nft].orig
  +++ File[/var/log/prometheus-node-textfile-check-nft]
  
  +    backup => False
  +    ensure => directory
  +    force  => True
  +    owner  => root
  +    mode   => 0755
  +    group  => root
  

• Systemd::Syslog[cfssl-ocsprefresh-debmonitor]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-debmonitor].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-debmonitor]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Logrotate::Conf[cfssl-ocsprefresh-zuul]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-zuul].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-zuul]
  
  -    ensure => present
  

• Service[nrpe2nodexp-check_certificate_expiry_wikikube.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_wikikube.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_wikikube.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]']
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_aux_front_proxy command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_aux_front_proxy
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "99cf4f8f014e8fd527800abcc213f494" --timeout 10 --check-command "check_check_certificate_expiry_aux_front_proxy"

• Nrpe::Check[check_check_certificate_expiry_aux_front_proxy]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_aux_front_proxy].orig
  +++ Nrpe::Check[check_check_certificate_expiry_aux_front_proxy]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
  -    before    => Monitoring::Service[check_certificate_expiry_aux_front_proxy]
  -    ensure    => present
  -    sudo_user => root
  

• File[/usr/local/sbin/cfssl-ocsprefresh]

  Parameters differences:

  --- File[/usr/local/sbin/cfssl-ocsprefresh].orig
  +++ File[/usr/local/sbin/cfssl-ocsprefresh]
  
  -    ensure => file
  -    owner  => root
  -    source => puppet:///modules/cfssl/cfssl_ocsprefresh.py
  -    mode   => 0550
  -    group  => root
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_debmonitor]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_debmonitor].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_debmonitor]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem

• Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@network_devices]']
  -    refreshonly => True
  

• Sudo::User[nrpe_certificate_check_dse]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_dse].orig
  +++ Sudo::User[nrpe_certificate_check_dse]
  
  -    user       => nrpe_certificate_check_dse
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]']
  -    refreshonly => True
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_etcd" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Cfssl::Ocsp[zuul]

  Parameters differences:

  --- Cfssl::Ocsp[zuul].orig
  +++ Cfssl::Ocsp[zuul]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/zuul/ca/zuul.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 10009
  -    db_driver          => mysql
  

• Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer].orig
  +++ Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Service[cfssl-ocsprefresh-discovery.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-discovery.timer].orig
  +++ Service[cfssl-ocsprefresh-discovery.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Ferm::Rule[dscp-default]

  Parameters differences:

  --- Ferm::Rule[dscp-default].orig
  +++ Ferm::Rule[dscp-default]
  
  -    ensure => present
  -    rule   => DSCP set-dscp-class CS0;
  -    chain  => POSTROUTING
  -    prio   => 99
  -    table  => mangle
  -    desc   => 
  -    domain => (ip ip6)
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_7cff186656c3cabbca85b5b57d0c8679]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_7cff186656c3cabbca85b5b57d0c8679].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_7cff186656c3cabbca85b5b57d0c8679]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_staging
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="7cff186656c3cabbca85b5b57d0c8679",check_name="check_check_certificate_expiry_mlserve_staging", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__mlserve_staging
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_staging
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_mlserve_staging))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-cassandra]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-cassandra].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-cassandra]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-cassandra.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-cassandra
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-cassandra
  -
  -/var/log/cfssl-ocsprefresh-cassandra/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Systemd::Override[apache2-after-network-online-target]

  Parameters differences:

  --- Systemd::Override[apache2-after-network-online-target].orig
  +++ Systemd::Override[apache2-after-network-online-target]
  
  -    ensure  => absent
  -    restart => False
  -    unit    => apache2
  

• Rsyslog::Conf[nrpe2nodexp-ferm_active]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-ferm_active].orig
  +++ Rsyslog::Conf[nrpe2nodexp-ferm_active]
  
  -    priority => 25
  -    ensure   => present
  -    mode     => 0444
  

• Cfssl::Cert[OCSP_puppet_rsa_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_puppet_rsa_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_puppet_rsa_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => puppet_rsa
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@puppet_rsa]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-mlserve_front_proxy" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-mlserve_front_proxy/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-discovery-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-discovery-certificate-expiry --cert-path /etc/cfssl/signers/discovery/ca/discovery.pem --outfile /var/lib/prometheus/node.d/discovery_intermediate.prom

• Systemd::Timer[cfssl-ocsprefresh-dse_front_proxy]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-dse_front_proxy].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-dse_front_proxy]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-dse_front_proxy.service
  

• Prometheus::Node_textfile[prometheus-check-wikikube_front_proxy-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-wikikube_front_proxy-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-wikikube_front_proxy-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_front_proxy_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Sudo::User[nrpe-check_check_cfssl-multirootca_status]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_cfssl-multirootca_status].orig
  +++ Sudo::User[nrpe-check_check_cfssl-multirootca_status]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    user       => nagios
  -    privileges => []
  -    tag        => nrpe::check
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_kafka command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_kafka
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "22922fd6bc2d570e018cbe5ccd8d1727" --timeout 10 --check-command "check_check_certificate_expiry_kafka"

• Systemd::Unit[cfssl-ocspserve@wikikube]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@wikikube].orig
  +++ Systemd::Unit[cfssl-ocspserve@wikikube]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@wikikube
  

• File[/etc/cfssl/signers/network_devices/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/network_devices/ca].orig
  +++ File[/etc/cfssl/signers/network_devices/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Sudo::User[nrpe_certificate_check_cloud_wmnet_ca]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_cloud_wmnet_ca].orig
  +++ Sudo::User[nrpe_certificate_check_cloud_wmnet_ca]
  
  -    user       => nrpe_certificate_check_cloud_wmnet_ca
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging]
  
  -    ensure => present
  

• File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft.orig
  +++ /etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft
  @@ -0,0 +1,10 @@
  +# Autogenerated by puppet
  +set DRUID_PUBLIC_HOSTS_ipv4 {
  +    type ipv4_addr
  +    elements = { 10.64.131.9,
  +             10.64.132.12,
  +             10.64.135.9,
  +             10.64.32.101,
  +             10.64.48.185
  +    }
  +}

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cassandra]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cassandra].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cassandra]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• File[/etc/confd/templates/_etc_ferm_conf.d_00_defs_requestctl.tmpl]

  Parameters differences:

  --- File[/etc/confd/templates/_etc_ferm_conf.d_00_defs_requestctl.tmpl].orig
  +++ File[/etc/confd/templates/_etc_ferm_conf.d_00_defs_requestctl.tmpl]
  
  @@
  -    ensure => present
  +    ensure => absent
  

• Service[cfssl-ocsprefresh-dse_front_proxy.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-dse_front_proxy.timer].orig
  +++ Service[cfssl-ocsprefresh-dse_front_proxy.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Prometheus::Blackbox::Check::Http[PKI_discovery]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_discovery].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_discovery]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"discovery"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_wikikube.timer
  

• File[/srv/cfssl/bundles/Puppet_Internal_CA.pem.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/Puppet_Internal_CA.pem.pem].orig
  +++ File[/srv/cfssl/bundles/Puppet_Internal_CA.pem.pem]
  
  -    ensure => file
  -    owner  => root
  -    source => /var/lib/puppet/ssl/certs/ca.pem
  -    mode   => 0444
  -    group  => root
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
  

• Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Systemd::Unit[wmf_auto_restart_apache2.timer]

  Parameters differences:

  --- Systemd::Unit[wmf_auto_restart_apache2.timer].orig
  +++ Systemd::Unit[wmf_auto_restart_apache2.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => wmf_auto_restart_apache2.timer
  

• Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging_front_proxy]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging_front_proxy].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging_front_proxy]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
  -    timeout                     => 10
  

• Nrpe::Check[check_check_certificate_expiry_mlserve]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_mlserve].orig
  +++ Nrpe::Check[check_check_certificate_expiry_mlserve]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem
  -    before    => Monitoring::Service[check_certificate_expiry_mlserve]
  -    ensure    => present
  -    sudo_user => root
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-aux_front_proxy-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --outfile /var/lib/prometheus/node.d/aux_front_proxy_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Cfssl::Cert[OCSP_cassandra_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_cassandra_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_cassandra_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => cassandra
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@cassandra]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-cassandra]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• Sudo::User[nrpe-check_check_certificate_expiry_kafka]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_kafka].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_kafka]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem']
  -    tag        => nrpe::check
  

• Nrpe::Check[check_check_certificate_expiry_kafka]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_kafka].orig
  +++ Nrpe::Check[check_check_certificate_expiry_kafka]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem
  -    before    => Monitoring::Service[check_certificate_expiry_kafka]
  -    ensure    => present
  -    sudo_user => root
  

• Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery2026]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery2026].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery2026]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_discovery2026.service
  

• File[/lib/systemd/system/cfssl-ocsprefresh-zuul.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-zuul.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-zuul.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-zuul.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-zuul.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - zuul
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/zuul/ca/zuul.pem --responses-file /etc/cfssl/ocsp/zuul.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@zuul' zuul 

• Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux -profile ocsp /etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_mlserve_staging" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Service[cfssl-ocspserve@mlserve_front_proxy]

  Parameters differences:

  --- Service[cfssl-ocspserve@mlserve_front_proxy].orig
  +++ Service[cfssl-ocspserve@mlserve_front_proxy]
  
  -    ensure => running
  -    enable => True
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_discovery2026.timer
  

• File[/etc/sudoers.d/nrpe_certificate_check_syslog]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_syslog].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_syslog]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Package[ulogd2]

  Parameters differences:

  --- Package[ulogd2].orig
  +++ Package[ulogd2]
  
  -    provider => apt
  -    ensure   => installed
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_discovery2026 command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_discovery2026
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "bf2e3510cb63e5f05f545e816bab4edf" --timeout 10 --check-command "check_check_certificate_expiry_discovery2026"

• Package[python3-cryptography]

  Parameters differences:

  --- Package[python3-cryptography].orig
  +++ Package[python3-cryptography]
  
  -    provider => apt
  -    ensure   => installed
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_wikikube_staging]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem

• Sudo::User[nrpe-check_check_certificate_expiry_discovery2026]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_discovery2026].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_discovery2026]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem']
  -    tag        => nrpe::check
  

• Monitoring::Service[check_certificate_expiry_puppet_rsa]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_puppet_rsa].orig
  +++ Monitoring::Service[check_certificate_expiry_puppet_rsa]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: puppet_rsa
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_puppet_rsa!10
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-mlserve_staging_front_proxy-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_front_proxy_intermediate.prom

• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Httpd::Site[pki.discovery.wmnet]

  Parameters differences:

  --- Httpd::Site[pki.discovery.wmnet].orig
  +++ Httpd::Site[pki.discovery.wmnet]
  
  -    priority => 50
  -    ensure   => present
  

• Logrotate::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-cloud_wmnet_ca].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]
  
  -    ensure => present
  

• Cfssl::Config[cassandra]

  Parameters differences:

  --- Cfssl::Config[cassandra].orig
  +++ Cfssl::Config[cassandra]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/cassandra/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/cassandra
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/cassandra
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages      => ['digital signature', 'key encipherment', 'server auth', 'client auth']
  

• File[/srv/cfssl/bundles/aux.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/aux.pem].orig
  +++ File[/srv/cfssl/bundles/aux.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/aux.pem.orig
  +++ /srv/cfssl/bundles/aux.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDpjCCAwegAwIBAgIUB83dKT9lbMGOLf38Jx6fmsSa714wCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjBx
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMQwwCgYDVQQDEwNhdXgwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABADhzJSO
  -h264ltJ1CVADYcfi1rIxQOY3gtAsxonZ6CWNueKg0vjvDeL32l+NZ3f2yj2CIzl5
  -sa6sZjXmwAKziuuvCAHmsZDY5gzgBdwhZ6UeGAbwlLMgQajwRvCA2RUMuH8iAd6o
  -QcfZyHQFb0zl9mCHYNkjLT4jpwrL4Lx/DGbmkE/ulqOCAQwwggEIMA4GA1UdDwEB
  -/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSPVQ8kSyOIH5l4
  -1mVGCudJoaowtTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
  -BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
  -bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
  -oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
  -bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCALJuWafVNInsE4Q8
  -tEHYHqhweF6bEArm7d3dqqTjKHuOcrmhXo4rgX5VsXHtI3qq9XGHoik6JUSwgftV
  -Sr+GWrIZAkIAuqmJ5vv2LgFcJWvYDkIPH9HXB9rIwAUHPFJ/iX2Ig9By+ss8nJbU
  -A3Ml/4NKRsXZwwyScmowVWQHfMpv53BsBv8=
  ------END CERTIFICATE-----

• File[/etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA
  -
  -/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/cfssl/signers/network_devices/ca/network_devices-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/network_devices/ca/network_devices-key.pem].orig
  +++ File[/etc/cfssl/signers/network_devices/ca/network_devices-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/network_devices/ca/network_devices-key.pem.orig
  +++ /etc/cfssl/signers/network_devices/ca/network_devices-key.pem
  @@ -1 +0,0 @@
  -fake key

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_wikikube.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_wikikube.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• Nrpe::Plugin[check_systemd_unit_status]

  Parameters differences:

  --- Nrpe::Plugin[check_systemd_unit_status].orig
  +++ Nrpe::Plugin[check_systemd_unit_status]
  
  -    source => puppet:///modules/systemd/check_systemd_unit_status
  -    ensure => present
  

• Systemd::Service[cfssl-ocspserve@wikikube_staging_front_proxy]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@wikikube_staging_front_proxy].orig
  +++ Systemd::Service[cfssl-ocspserve@wikikube_staging_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-network_devices.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-network_devices.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-network_devices.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-network_devices.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Cfssl::Ocsp[aux_front_proxy]

  Parameters differences:

  --- Cfssl::Ocsp[aux_front_proxy].orig
  +++ Cfssl::Ocsp[aux_front_proxy]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 20051
  -    db_driver          => mysql
  

• Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve -profile ocsp /etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-aux-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-aux-certificate-expiry --cert-path /etc/cfssl/signers/aux/ca/aux.pem --outfile /var/lib/prometheus/node.d/aux_intermediate.prom

• File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
  
  -    ensure => present
  

• File[/etc/systemd/system/nftables.service.d]

  Parameters differences:

  --- File[/etc/systemd/system/nftables.service.d].orig
  +++ File[/etc/systemd/system/nftables.service.d]
  
  +    ensure => directory
  +    mode   => 0555
  +    group  => root
  +    owner  => root
  

• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/etc/cfssl/signers/discovery2026/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/discovery2026/ca].orig
  +++ File[/etc/cfssl/signers/discovery2026/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]']
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Sudo::User[nrpe_certificate_check_mlserve_staging]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_mlserve_staging].orig
  +++ Sudo::User[nrpe_certificate_check_mlserve_staging]
  
  -    user       => nrpe_certificate_check_mlserve_staging
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• File[/etc/ssl/dhparam.pem]

  Parameters differences:

  --- File[/etc/ssl/dhparam.pem].orig
  +++ File[/etc/ssl/dhparam.pem]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/sslcert/dhparam.pem
  -    mode   => 0444
  -    group  => root
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery2026]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery2026].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery2026]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: discovery2026
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_discovery2026!10
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Service[cfssl-ocspserve@cassandra]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@cassandra].orig
  +++ Systemd::Service[cfssl-ocspserve@cassandra]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Logrotate::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
  
  -    ensure => present
  

• Rsyslog::Conf[cfssl-ocsprefresh-network_devices]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-network_devices].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-network_devices]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-network_devices]
  -    ensure   => present
  -    mode     => 0444
  

• Systemd::Service[cfssl-ocspserve@dse]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@dse].orig
  +++ Systemd::Service[cfssl-ocspserve@dse]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_discovery_38e4dbcfd07ed60daf5bb89397abbe29]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_discovery_38e4dbcfd07ed60daf5bb89397abbe29].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_discovery_38e4dbcfd07ed60daf5bb89397abbe29]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: discovery
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="38e4dbcfd07ed60daf5bb89397abbe29",check_name="check_check_certificate_expiry_discovery", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__discovery
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: discovery
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_discovery))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Cfssl::Ocsp[Wikimedia_Internal_Root_CA]

  Parameters differences:

  --- Cfssl::Ocsp[Wikimedia_Internal_Root_CA].orig
  +++ Cfssl::Ocsp[Wikimedia_Internal_Root_CA]
  
  -    log_level          => info
  -    ca_file            => /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem
  -    ocsprefresh_update => True
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 10000
  -    cert_content       => -----BEGIN CERTIFICATE-----
  MIIDmzCCAvygAwIBAgIUN3uLiKCNVwnGG5H9qKGwTGT4fJowCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjEwMzI1MTQ1MTAwWhcNMjYwMzI0MTQ1MTAwWjCB
  mTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxFzAVBgNVBAsTDkNsb3VkIFNlcnZp
  Y2VzMTUwMwYDVQQDDCxXaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQV9vY3NwX3Np
  Z25pbmdfY2VydDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLmGOcHNNTGsOVTG
  17o/lTVCgVJqX751quqBZvJQUbAgfAv0PRgv6yjWzTmZnojzKHYRaV8NXhDIVBzo
  l2DRWUOjggEbMIIBFzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUH
  AwkwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQULRRzzcjqWQc2Fjci5s2v0FKSPJww
  HwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBI
  MEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dp
  a2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6
  Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
  dF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgCI41DoiQFxqs9gDCZs4VhwcNeatHqe
  98IqBIzFOMdZdkUnyTNiXf0VDkUYZ+n2mYmB5ZAaBTPYhTHgLNrc3KsmpQJCAfHM
  Qr3AEz1MlZq2krL+7Mx9OuBQ3B/hXyC+met7EmKDziU8UyScxFfSIY1lwwgAmZHA
  OEOWpgzuF4fGZFVf0dFi
  -----END CERTIFICATE-----
  
  -    db_driver          => mysql
  -    require            => Service[cfssl-multirootca]
  -    key_content        => FAKE FAKE FAKE
  
  

• Systemd::Timer::Job[prometheus-node-textfile-check-nft]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-check-nft].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-check-nft]
  
  +    send_mail_to              => root@pki1001.eqiad.wmnet
  +    logging_enabled           => True
  +    interval                  => {'start': 'OnCalendar', 'interval': '*:0/30'}
  +    ignore_errors             => False
  +    private_tmp               => False
  +    description               => Systemd timer to gather node metrics for check-nft
  +    syslog_match_startswith   => True
  +    command                   => /usr/local/bin/check-nft
  +    logfile_basedir           => /var/log
  +    user                      => root
  +    environment               => {}
  +    logfile_name              => syslog.log
  +    send_mail_only_on_error   => True
  +    logfile_group             => root
  +    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    fixed_random_delay        => False
  +    ensure                    => present
  +    success_exit_status       => []
  +    syslog_force_stop         => True
  +    logfile_perms             => all
  +    monitoring_contact_groups => admins
  +    send_mail                 => False
  +    monitoring_enabled        => False
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Rsyslog::Conf[cfssl-ocsprefresh-aux]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-aux].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-aux]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-aux]
  -    ensure   => present
  -    mode     => 0444
  

• File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-aux_front_proxy.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-aux_front_proxy.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-wikikube_staging_front_proxy
  -
  -/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - debmonitor
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --responses-file /etc/cfssl/ocsp/debmonitor.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@debmonitor' debmonitor 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
  

• File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem].orig
  +++ File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem.orig
  +++ /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDrzCCAxKgAwIBAgIURAaLNJ85iLqv3Tqt4ylu7Dhe0o0wCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjExMjEzMTg1NTAwWhcNMjYxMjEyMTg1NTAwWjB8
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRcwFQYDVQQDDA5jbG91ZF93bW5ldF9jYTCBmzAQBgcqhkjOPQIBBgUrgQQA
  -IwOBhgAEAFsH4mfZKGu87WTpX9yabGE0+vO4UBQaN/IUGnjmscZTZ7761iAwuZcs
  -33yjwzoX2W+R0IwAPJbagtB92uYPmA6eAUDV4WAuOml+AqAP0elVtW7i+T/Bm4qc
  -SrlGCDsALgJ765YZCDS9OmzAm9rXbQXFmsxqrm9I3aPXIOWIww5+Zg1mo4IBDDCC
  -AQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
  -FMavCWJlEuGLgOx5zgBdQCQ0Zxj7MB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGD
  -kdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5k
  -aXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBK
  -BgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwv
  -V2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYoAMIGGAkEQ
  -XFKpUB99oxOp7uK3GztZblTr8DECjcwbJOXYfZLGyfzzNIKPMGPkBGNmGkP7Ie1G
  -RSCNRsI1VR8/geUR0YUrpwJBRZWF4DZM3cga+6VB7pEv/7r/pQERs/ivzckNwDLi
  -/LK1pbHc/MeNOdoy7TouLf1djsw40VYtGNT7/9FldHoWqsA=
  ------END CERTIFICATE-----

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Cfssl::Signer[zuul]

  Parameters differences:

  --- Cfssl::Signer[zuul].orig
  +++ Cfssl::Signer[zuul]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/zuul/ca/zuul.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDpzCCAwigAwIBAgIUMIxkteGnxVGRNFWjJZ+eXPnOeM8wCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjUwODIwMTg1NTAwWhcNMzAwODE5MTg1NTAwWjBy
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMQ0wCwYDVQQDEwR6dXVsMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBNx/m
  dSpc4EWI68Y36PVvDkvyqlJ6pA4sEXQCrNOM+0jSACRM8Shwqr7uC/JmuP8GIdK3
  g+SgxQOjF9pfelX2OpAB6leOfgHXhFtzJquX261tKsxQm74cszycF9YTiWDKVq0V
  g7bFNgf4NcC7NxGfN4SuA58I7dQWJxSWdzTJNQsF2uijggEMMIIBCDAOBgNVHQ8B
  Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUqyQEoVfbsJqL
  jr5RyZovCpWdRZUwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
  KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
  bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
  P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
  SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgER9R3mwAtzYcIh
  HAnL2SiHTXBpqitQp6Ce+7nYFP0qyu+Ggkx2bu86bl32lGmvA6ecTKXDiyXW5pMW
  atmKn0wAegJCAaU9pfWuLIgsVqzB2zvDWMR2HgBMa6MO7dRlG2VUoLvR16NF9cln
  XjNzIqPRxUpiD5TNC4+p9BoT+RRXEDUeRufH
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => nosecret
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/zuul
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/zuul
  -    ca_key_file      => /etc/cfssl/signers/zuul/ca/zuul-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages   => ['server auth', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label network_devices -profile ocsp /etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Package[apache2]

  Parameters differences:

  --- Package[apache2].orig
  +++ Package[apache2]
  
  -    provider => apt
  -    ensure   => installed
  

• Sudo::User[nrpe_certificate_check_wikikube_staging]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_wikikube_staging].orig
  +++ Sudo::User[nrpe_certificate_check_wikikube_staging]
  
  -    user       => nrpe_certificate_check_wikikube_staging
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_mlserve_staging]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem

• File[/etc/cfssl/ocsp/dse_front_proxy.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/dse_front_proxy.ocsp].orig
  +++ File[/etc/cfssl/ocsp/dse_front_proxy.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• File[/etc/cfssl/signers/wikikube/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube/ca].orig
  +++ File[/etc/cfssl/signers/wikikube/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• File[/etc/cfssl/signers/kafka/ca/kafka-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/kafka/ca/kafka-key.pem].orig
  +++ File[/etc/cfssl/signers/kafka/ca/kafka-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_aux.timer
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-dse" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-dse/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Class[Profile::Puppet::Agent]

  Parameters differences:

  --- Class[Profile::Puppet::Agent].orig
  +++ Class[Profile::Puppet::Agent]
  
  @@
  -    dns_alt_names => ['pki.discovery.wmnet']
  +    dns_alt_names => []
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/cfssl/ocsp/wikikube_front_proxy.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/wikikube_front_proxy.ocsp].orig
  +++ File[/etc/cfssl/ocsp/wikikube_front_proxy.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Exec[renew certificate - OCSP_debmonitor_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_debmonitor_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_debmonitor_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label debmonitor -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Nrpe::Monitor_service[check_certificate_expiry_zuul]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_zuul].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_zuul]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: zuul
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem
  -    timeout                     => 10
  

• File[/lib/systemd/system/nrpe2nodexp-ferm_active.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-ferm_active.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-ferm_active.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.service (nrpe2nodexp-ferm_active.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-ferm_active.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-ferm_active.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_ferm_active command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-ferm_active
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "bba0a2572329bb500b832470e08b381c" --timeout 10 --check-command "check_ferm_active"

• File[/etc/cfssl/signers/mlserve/ca/mlserve.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve/ca/mlserve.pem].orig
  +++ File[/etc/cfssl/signers/mlserve/ca/mlserve.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/mlserve/ca/mlserve.pem.orig
  +++ /etc/cfssl/signers/mlserve/ca/mlserve.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDqTCCAwugAwIBAgIUC2E+U3FwNsKpcXq1D5KD3ILh08QwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB1
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRAwDgYDVQQDEwdtbHNlcnZlMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA
  -4+yIcr5bDRYOqvzsS95b/CFOM84v7vZlxRXO9paOop7nSpVED1+upVrhfM69F4Rd
  -hMDYeRBUiXxZsecByAdWu0AAEWeCZiL+QqMEJeoGML8iobA6rGa+5y2qePBUcV5m
  -4u0sePHBq8CYXdIgPHo8bIho/A30Q/IhwEIln0OoSq1ZlcOjggEMMIIBCDAOBgNV
  -HQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUYMFEsH4H
  -fAVzgmuJIW+M+s7UPVEwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYw
  -VgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVy
  -eS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRD
  -MEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVk
  -aWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQUW5mZclFy2C
  -6VREX3v/LuAnzguojsBHnRSGXWR1TYoN8aBrtzC0w6KaC+5ka5VCByGmlMDY4GxF
  -GLuM8bnvHf4FAkIBva6mukWZ7ZKbNSGakTVG3PeEvZs1b4xkq7+6RYjlv819FjLm
  -jPag2y90JiWcyA7gw4IZqc3BgFuT46K+AqsKzhY=
  ------END CERTIFICATE-----

• Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Service[cfssl-ocspserve@mlserve_staging]

  Parameters differences:

  --- Service[cfssl-ocspserve@mlserve_staging].orig
  +++ Service[cfssl-ocspserve@mlserve_staging]
  
  -    ensure => running
  -    enable => True
  

• File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft.orig
  +++ /etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft
  @@ -0,0 +1,7 @@
  +# Autogenerated by puppet
  +set DEPLOYMENT_HOSTS_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:102:10:64:16:93,
  +             2620:0:860:103:10:192:32:7
  +    }
  +}

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/cfssl/signers/puppet_rsa]

  Parameters differences:

  --- File[/etc/cfssl/signers/puppet_rsa].orig
  +++ File[/etc/cfssl/signers/puppet_rsa]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Logrotate::Conf[cfssl-ocsprefresh-discovery]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-discovery].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-discovery]
  
  -    ensure => present
  

• Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@dse_front_proxy]']
  -    refreshonly => True
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_discovery2026.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_discovery2026.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/lib/systemd/system/cfssl-gc-expired-certs.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-gc-expired-certs.service].orig
  +++ File[/lib/systemd/system/cfssl-gc-expired-certs.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-gc-expired-certs.service.orig
  +++ /lib/systemd/system/cfssl-gc-expired-certs.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Delete expired Certificates from the cfssl DB
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-certs clean

• File[/var/log/cfssl-ocsprefresh-zuul]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-zuul].orig
  +++ File[/var/log/cfssl-ocsprefresh-zuul]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/etc/cfssl/ocsp/cloud_wmnet_ca.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/cloud_wmnet_ca.ocsp].orig
  +++ File[/etc/cfssl/ocsp/cloud_wmnet_ca.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Nrpe::Monitor_service[check_certificate_expiry_mlserve]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_mlserve].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_mlserve]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: mlserve
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem
  -    timeout                     => 10
  

• File[/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer
  

• File[/usr/local/bin/check-nft]

  Parameters differences:

  --- File[/usr/local/bin/check-nft].orig
  +++ File[/usr/local/bin/check-nft]
  
  +    ensure => present
  +    owner  => root
  +    source => puppet:///modules/profile/firewall/check_nftables.py
  +    mode   => 0555
  +    group  => root
  

• Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-status-restart)]

  Parameters differences:

  --- Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-status-restart)].orig
  +++ Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-status-restart)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[ferm]']
  -    refreshonly => True
  

• Systemd::Timer[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
  

• File[/lib/systemd/system/cfssl-multirootca.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-multirootca.service].orig
  +++ File[/lib/systemd/system/cfssl-multirootca.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-multirootca.service.orig
  +++ /lib/systemd/system/cfssl-multirootca.service
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL MultiRootCA
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/blob/master/doc/cmd/multiroot.txt
  -
  -[Service]
  -ExecStart=/usr/bin/multirootca \
  -          -a "127.0.0.1:8888" \
  -          -roots /etc/cfssl/multiroot.conf 
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Timer[cfssl-ocsprefresh-zuul]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-zuul].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-zuul]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-zuul.service
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-puppet_rsa.timer
  

• Systemd::Service[nftables]

  Parameters differences:

  --- Systemd::Service[nftables].orig
  +++ Systemd::Service[nftables]
  
  +    migration_task           => T407130
  +    unit_type                => service
  +    ensure                   => present
  +    monitoring_critical      => False
  +    restart                  => False
  +    service_params           => {'hasrestart': True, 'restart': '/usr/bin/systemctl reload nftables'}
  +    override                 => True
  +    monitoring_enabled       => False
  +    monitoring_contact_group => admins
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_network_devices command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_network_devices
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "21dac3775d059b8c991626e2ca33f951" --timeout 10 --check-command "check_check_certificate_expiry_network_devices"

• Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Systemd::Syslog[cfssl-ocsprefresh-cloud_wmnet_ca]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-cloud_wmnet_ca].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-cloud_wmnet_ca]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/srv/cfssl/bundles/mlserve.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/mlserve.pem].orig
  +++ File[/srv/cfssl/bundles/mlserve.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/mlserve.pem.orig
  +++ /srv/cfssl/bundles/mlserve.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDqTCCAwugAwIBAgIUC2E+U3FwNsKpcXq1D5KD3ILh08QwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB1
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRAwDgYDVQQDEwdtbHNlcnZlMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA
  -4+yIcr5bDRYOqvzsS95b/CFOM84v7vZlxRXO9paOop7nSpVED1+upVrhfM69F4Rd
  -hMDYeRBUiXxZsecByAdWu0AAEWeCZiL+QqMEJeoGML8iobA6rGa+5y2qePBUcV5m
  -4u0sePHBq8CYXdIgPHo8bIho/A30Q/IhwEIln0OoSq1ZlcOjggEMMIIBCDAOBgNV
  -HQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUYMFEsH4H
  -fAVzgmuJIW+M+s7UPVEwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYw
  -VgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVy
  -eS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRD
  -MEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVk
  -aWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQUW5mZclFy2C
  -6VREX3v/LuAnzguojsBHnRSGXWR1TYoN8aBrtzC0w6KaC+5ka5VCByGmlMDY4GxF
  -GLuM8bnvHf4FAkIBva6mukWZ7ZKbNSGakTVG3PeEvZs1b4xkq7+6RYjlv819FjLm
  -jPag2y90JiWcyA7gw4IZqc3BgFuT46K+AqsKzhY=
  ------END CERTIFICATE-----

• File[/etc/systemd/system/ferm.service.d]

  Parameters differences:

  --- File[/etc/systemd/system/ferm.service.d].orig
  +++ File[/etc/systemd/system/ferm.service.d]
  
  -    ensure => directory
  -    mode   => 0555
  -    group  => root
  -    owner  => root
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Prometheus::Blackbox::Check::Http[PKI_debmonitor]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_debmonitor].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_debmonitor]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"debmonitor"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• File[/etc/cfssl/signers/syslog]

  Parameters differences:

  --- File[/etc/cfssl/signers/syslog].orig
  +++ File[/etc/cfssl/signers/syslog]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Class[Profile::Monitoring]

  Parameters differences:

  --- Class[Profile::Monitoring].orig
  +++ Class[Profile::Monitoring]
  
  @@
  -    cluster               => pki
  +    cluster               => insetup
  @@
  -    notifications_enabled => True
  +    notifications_enabled => False
  @@
  -    nagios_group          => pki_eqiad
  +    nagios_group          => insetup_eqiad
  

• Rsyslog::Conf[nrpe2nodexp-check_cfssl-multirootca_status]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_cfssl-multirootca_status].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_cfssl-multirootca_status]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods]

  Parameters differences:

  --- File[/etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods].orig
  +++ File[/etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods]
  
  -    notify  => Service[ferm]
  -    require => File[/etc/ferm/conf.d]
  -    ensure  => present
  -    owner   => root
  -    tag     => ferm
  -    mode    => 0400
  -    group   => root
  

  Content differences:

  --- /etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods.orig
  +++ /etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods
  @@ -1,6 +0,0 @@
  -# Autogenerated by puppet. DO NOT EDIT BY HAND!
  -#
  -# 
  -&R_SERVICE(tcp, 8443, ($WIKIKUBE_KUBEPODS_NETWORKS $STAGING_KUBEPODS_NETWORKS $MLSERVE_KUBEPODS_NETWORKS $MLSTAGE_KUBEPODS_NETWORKS $DSE_KUBEPODS_NETWORKS $AUX_KUBEPODS_NETWORKS));
  -
  -

• Systemd::Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Prometheus::Alert::Rule[check_ferm_active_bba0a2572329bb500b832470e08b381c]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_ferm_active_bba0a2572329bb500b832470e08b381c].orig
  +++ Prometheus::Alert::Rule[check_ferm_active_bba0a2572329bb500b832470e08b381c]
  
  -    summary            => NRPE CHECK: Check whether ferm is active by checking the default input chain
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="bba0a2572329bb500b832470e08b381c",check_name="check_ferm_active", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => present
  -    runbook            => https://wikitech.wikimedia.org/wiki/Monitoring/check_ferm
  -    alert_name         => nrpe_Check_whether_ferm_is_active_by_checking_the_default_input_chain
  -    instance           => ops
  -    description        => NRPE CHECK: Check whether ferm is active by checking the default input chain
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_ferm_active))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 32m
  -    group              => nrpechecks
  

• Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Nftables::Set[BASTION_HOSTS]

  Parameters differences:

  --- Nftables::Set[BASTION_HOSTS].orig
  +++ Nftables::Set[BASTION_HOSTS]
  
  +    hosts  => ['208.80.154.7', '2620:0:861:1:208:80:154:7', '208.80.153.110', '2a02:ec80:300:3:185:15:59:99', '185.15.59.99', '2620:0:860:4:208:80:153:110', '198.35.26.104', '2620:0:863:3:198:35:26:104', '103.102.166.103', '2001:df2:e500:3:103:102:166:103', '185.15.58.6', '2a02:ec80:600:1:185:15:58:6', '195.200.68.99', '2a02:ec80:700:3:195:200:68:99']
  +    ensure => present
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/signers/discovery2026/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/discovery2026/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/discovery2026/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/discovery2026/cfssl.conf.orig
  +++ /etc/cfssl/signers/discovery2026/cfssl.conf
  @@ -1,129 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "digital signature",
  -        "key encipherment",
  -        "server auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/discovery2026",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/discovery2026"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "k8s_staging": {
  -        "auth_key": "k8s_staging",
  -        "expiry": "24h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "k8s_wikikube": {
  -        "auth_key": "k8s_wikikube",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "k8s_mlserve": {
  -        "auth_key": "k8s_mlserve",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "k8s_mlstaging": {
  -        "auth_key": "k8s_mlstaging",
  -        "expiry": "24h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "k8s_dse": {
  -        "auth_key": "k8s_dse",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth",
  -          "client auth"
  -        ]
  -      },
  -      "k8s_dse_opensearch": {
  -        "auth_key": "k8s_dse",
  -        "expiry": "4380h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth",
  -          "client auth"
  -        ]
  -      },
  -      "k8s_aux": {
  -        "auth_key": "k8s_aux",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Exec[renew certificate - OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_dse_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
  

• File[/etc/cfssl/signers/syslog/ca/syslog-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/syslog/ca/syslog-key.pem].orig
  +++ File[/etc/cfssl/signers/syslog/ca/syslog-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/syslog/ca/syslog-key.pem.orig
  +++ /etc/cfssl/signers/syslog/ca/syslog-key.pem
  @@ -1 +0,0 @@
  -nosecret

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_puppet_rsa].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_puppet_rsa command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "c1b324b3d8ac107f8d7483b4017f5edf" --timeout 10 --check-command "check_check_certificate_expiry_puppet_rsa"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_puppet_rsa
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/apache2/conf-enabled/50-server-status.conf]

  Parameters differences:

  --- File[/etc/apache2/conf-enabled/50-server-status.conf].orig
  +++ File[/etc/apache2/conf-enabled/50-server-status.conf]
  
  -    notify => Service[apache2]
  -    ensure => link
  -    target => /etc/apache2/conf-available/50-server-status.conf
  -    owner  => root
  -    group  => root
  

• Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-dse_front_proxy.timer
  

• Cfssl::Signer[mlserve]

  Parameters differences:

  --- Cfssl::Signer[mlserve].orig
  +++ Cfssl::Signer[mlserve]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/mlserve/ca/mlserve.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDqTCCAwugAwIBAgIUC2E+U3FwNsKpcXq1D5KD3ILh08QwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB1
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMRAwDgYDVQQDEwdtbHNlcnZlMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA
  4+yIcr5bDRYOqvzsS95b/CFOM84v7vZlxRXO9paOop7nSpVED1+upVrhfM69F4Rd
  hMDYeRBUiXxZsecByAdWu0AAEWeCZiL+QqMEJeoGML8iobA6rGa+5y2qePBUcV5m
  4u0sePHBq8CYXdIgPHo8bIho/A30Q/IhwEIln0OoSq1ZlcOjggEMMIIBCDAOBgNV
  HQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUYMFEsH4H
  fAVzgmuJIW+M+s7UPVEwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYw
  VgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVy
  eS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRD
  MEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVk
  aWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQUW5mZclFy2C
  6VREX3v/LuAnzguojsBHnRSGXWR1TYoN8aBrtzC0w6KaC+5ka5VCByGmlMDY4GxF
  GLuM8bnvHf4FAkIBva6mukWZ7ZKbNSGakTVG3PeEvZs1b4xkq7+6RYjlv819FjLm
  jPag2y90JiWcyA7gw4IZqc3BgFuT46K+AqsKzhY=
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => nosecret
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/mlserve
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/mlserve
  -    ca_key_file      => /etc/cfssl/signers/mlserve/ca/mlserve-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages   => ['signing', 'key encipherment', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_zuul_373325faaa689f3e9b058d91d4eb6cdb]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_zuul_373325faaa689f3e9b058d91d4eb6cdb].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_zuul_373325faaa689f3e9b058d91d4eb6cdb]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: zuul
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="373325faaa689f3e9b058d91d4eb6cdb",check_name="check_check_certificate_expiry_zuul", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__zuul
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: zuul
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_zuul))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Prometheus::Node_textfile[prometheus-check-cloud_wmnet_ca-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-cloud_wmnet_ca-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry --cert-path /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --outfile /var/lib/prometheus/node.d/cloud_wmnet_ca_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_aux_front_proxy" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_dse.service
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• Service[cfssl-ocspserve@network_devices]

  Parameters differences:

  --- Service[cfssl-ocspserve@network_devices].orig
  +++ Service[cfssl-ocspserve@network_devices]
  
  -    ensure => running
  -    enable => True
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem

• Sudo::User[nrpe-check_check_certificate_expiry_puppet_rsa]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_puppet_rsa].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_puppet_rsa]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem']
  -    tag        => nrpe::check
  

• Ferm::Service[ssh_from_bastion]

  Parameters differences:

  --- Ferm::Service[ssh_from_bastion].orig
  +++ Ferm::Service[ssh_from_bastion]
  
  -    srange              => ['208.80.154.7', '2620:0:861:1:208:80:154:7', '208.80.153.110', '2a02:ec80:300:3:185:15:59:99', '185.15.59.99', '2620:0:860:4:208:80:153:110', '198.35.26.104', '2620:0:863:3:198:35:26:104', '103.102.166.103', '2001:df2:e500:3:103:102:166:103', '185.15.58.6', '2a02:ec80:600:1:185:15:58:6', '195.200.68.99', '2a02:ec80:700:3:195:200:68:99']
  -    ensure              => present
  -    port                => 22
  -    prio                => 10
  -    desc                => 
  -    proto               => tcp
  -    unrestricted_access => False
  -    notrack             => False
  

• Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: wikikube_staging
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
  -    timeout                     => 10
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-discovery2026-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-discovery2026-certificate-expiry --cert-path /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --outfile /var/lib/prometheus/node.d/discovery2026_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-wikikube_front_proxy-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_front_proxy_intermediate.prom

• Systemd::Timer::Job[cfssl-ocsprefresh-cassandra]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-cassandra].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-cassandra]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - cassandra
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/cassandra/ca/cassandra.pem --responses-file /etc/cfssl/ocsp/cassandra.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@cassandra' cassandra 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/lib/systemd/system/wmf_auto_restart_apache2.timer]

  Parameters differences:

  --- File[/lib/systemd/system/wmf_auto_restart_apache2.timer].orig
  +++ File[/lib/systemd/system/wmf_auto_restart_apache2.timer]
  
  -    notify => Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/wmf_auto_restart_apache2.timer.orig
  +++ /lib/systemd/system/wmf_auto_restart_apache2.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of wmf_auto_restart_apache2.service
  -
  -[Timer]
  -Unit=wmf_auto_restart_apache2.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 22:8:00
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem].orig
  +++ File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem.orig
  +++ /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem
  @@ -1 +0,0 @@
  -nosecret

• Service[cfssl-ocspserve@wikikube_staging]

  Parameters differences:

  --- Service[cfssl-ocspserve@wikikube_staging].orig
  +++ Service[cfssl-ocspserve@wikikube_staging]
  
  -    ensure => running
  -    enable => True
  

• File[/etc/ferm/conf.d]

  Parameters differences:

  --- File[/etc/ferm/conf.d].orig
  +++ File[/etc/ferm/conf.d]
  
  -    notify  => Service[ferm]
  -    ensure  => directory
  -    recurse => True
  -    purge   => True
  -    ignore  => ['.*']
  -    mode    => 0551
  -    require => Package[ferm]
  -    force   => True
  -    owner   => root
  -    group   => adm
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/cfssl/signers/zuul/ca/zuul-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/zuul/ca/zuul-key.pem].orig
  +++ File[/etc/cfssl/signers/zuul/ca/zuul-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/zuul/ca/zuul-key.pem.orig
  +++ /etc/cfssl/signers/zuul/ca/zuul-key.pem
  @@ -1 +0,0 @@
  -nosecret

• Cfssl::Ocsp[wikikube_front_proxy]

  Parameters differences:

  --- Cfssl::Ocsp[wikikube_front_proxy].orig
  +++ Cfssl::Ocsp[wikikube_front_proxy]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 20011
  -    db_driver          => mysql
  

• Service[cfssl-ocsprefresh-wikikube_staging.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-wikikube_staging.timer].orig
  +++ Service[cfssl-ocsprefresh-wikikube_staging.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cloud_wmnet_ca -profile ocsp /etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/usr/local/bin/apache-status]

  Parameters differences:

  --- File[/usr/local/bin/apache-status].orig
  +++ File[/usr/local/bin/apache-status]
  
  -    source => puppet:///modules/httpd/apache-status
  -    mode   => 0555
  -    group  => root
  -    owner  => root
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_puppet_rsa]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem

• File[/var/log/cfssl-ocsprefresh-puppet_rsa]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-puppet_rsa].orig
  +++ File[/var/log/cfssl-ocsprefresh-puppet_rsa]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Service[cfssl-ocspserve@kafka]

  Parameters differences:

  --- Service[cfssl-ocspserve@kafka].orig
  +++ Service[cfssl-ocspserve@kafka]
  
  -    ensure => running
  -    enable => True
  

• File[/etc/ferm/conf.d/10_csr_and_ocsp_responder]

  Parameters differences:

  --- File[/etc/ferm/conf.d/10_csr_and_ocsp_responder].orig
  +++ File[/etc/ferm/conf.d/10_csr_and_ocsp_responder]
  
  -    notify  => Service[ferm]
  -    require => File[/etc/ferm/conf.d]
  -    ensure  => present
  -    owner   => root
  -    tag     => ferm
  -    mode    => 0400
  -    group   => root
  

  Content differences:

  --- /etc/ferm/conf.d/10_csr_and_ocsp_responder.orig
  +++ /etc/ferm/conf.d/10_csr_and_ocsp_responder
  @@ -1,6 +0,0 @@
  -# Autogenerated by puppet. DO NOT EDIT BY HAND!
  -#
  -# 
  -&R_SERVICE(tcp, 80, ($DOMAIN_NETWORKS $MGMT_NETWORKS));
  -
  -

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
  
  -    ensure => present
  

• File[/var/log/cfssl-ocsprefresh-wikikube]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-wikikube].orig
  +++ File[/var/log/cfssl-ocsprefresh-wikikube]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Timer[prometheus-node-textfile-check-nft]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-check-nft].orig
  +++ Systemd::Timer[prometheus-node-textfile-check-nft]
  
  +    fixed_random_delay => False
  +    ensure             => present
  +    accuracy           => 15sec
  +    splay              => 0
  +    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*:0/30'}]
  +    unit_name          => prometheus-node-textfile-check-nft.service
  

• Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label etcd -profile ocsp /etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging_front_proxy.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging_front_proxy.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging_front_proxy.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Nftables::Set[CACHES]

  Parameters differences:

  --- Nftables::Set[CACHES].orig
  +++ Nftables::Set[CACHES]
  
  +    hosts  => ['10.64.0.79', '2620:0:861:101:10:64:0:79', '10.64.0.229', '2620:0:861:101:10:64:0:229', '10.64.0.14', '2620:0:861:101:10:64:0:14', '10.64.0.51', '2620:0:861:101:10:64:0:51', '10.64.16.241', '2620:0:861:102:10:64:16:241', '10.64.16.94', '2620:0:861:102:10:64:16:94', '10.64.16.95', '2620:0:861:102:10:64:16:95', '10.64.16.240', '2620:0:861:102:10:64:16:240', '10.64.32.14', '2620:0:861:103:10:64:32:14', '10.64.32.60', '2620:0:861:103:10:64:32:60', '10.64.32.15', '2620:0:861:103:10:64:32:15', '10.64.32.65', '2620:0:861:103:10:64:32:65', '10.64.48.16', '2620:0:861:107:10:64:48:16', '10.64.48.41', '2620:0:861:107:10:64:48:41', '10.64.48.27', '2620:0:861:107:10:64:48:27', '10.64.48.28', '2620:0:861:107:10:64:48:28', '10.192.23.26', '2620:0:860:113:10:192:23:26', '10.192.6.20', '2620:0:860:107:10:192:6:20', '10.192.12.35', '2620:0:860:10d:10:192:12:35', '10.192.14.25', '2620:0:860:10f:10:192:14:25', '10.192.4.22', '2620:0:860:100:10:192:4:22', '10.192.29.26', '2620:0:860:116:10:192:29:26', '10.192.30.29', '2620:0:860:119:10:192:30:29', '10.192.36.19', '2620:0:860:11b:10:192:36:19', '10.192.40.25', '2620:0:860:11f:10:192:40:25', '10.192.41.21', '2620:0:860:120:10:192:41:21', '10.192.56.3', '2620:0:860:12b:10:192:56:3', '10.192.56.4', '2620:0:860:12b:10:192:56:4', '10.192.57.3', '2620:0:860:12c:10:192:57:3', '10.192.58.2', '2620:0:860:12d:10:192:58:2', '10.192.58.3', '2620:0:860:12d:10:192:58:3', '10.192.59.2', '2620:0:860:12e:10:192:59:2', '10.80.0.14', '2a02:ec80:300:101:10:80:0:14', '10.80.1.11', '2a02:ec80:300:102:10:80:1:11', '10.80.0.13', '2a02:ec80:300:101:10:80:0:13', '10.80.1.9', '2a02:ec80:300:102:10:80:1:9', '10.80.0.12', '2a02:ec80:300:101:10:80:0:12', '10.80.1.7', '2a02:ec80:300:102:10:80:1:7', '10.80.0.11', '2a02:ec80:300:101:10:80:0:11', '10.80.1.6', '2a02:ec80:300:102:10:80:1:6', '10.80.0.10', '2a02:ec80:300:101:10:80:0:10', '10.80.1.5', '2a02:ec80:300:102:10:80:1:5', '10.80.0.8', '2a02:ec80:300:101:10:80:0:8', '10.80.1.4', '2a02:ec80:300:102:10:80:1:4', '10.80.0.7', '2a02:ec80:300:101:10:80:0:7', '10.80.1.3', '2a02:ec80:300:102:10:80:1:3', '10.80.0.6', '2a02:ec80:300:101:10:80:0:6', '10.80.1.2', '2a02:ec80:300:102:10:80:1:2', '10.128.0.19', '2620:0:863:101:10:128:0:19', '10.128.0.27', '2620:0:863:101:10:128:0:27', '10.128.0.22', '2620:0:863:101:10:128:0:22', '10.128.0.28', '2620:0:863:101:10:128:0:28', '10.128.0.25', '2620:0:863:101:10:128:0:25', '10.128.0.29', '2620:0:863:101:10:128:0:29', '10.128.0.26', '2620:0:863:101:10:128:0:26', '10.128.0.31', '2620:0:863:101:10:128:0:31', '10.128.0.14', '2620:0:863:101:10:128:0:14', '10.128.0.35', '2620:0:863:101:10:128:0:35', '10.128.0.21', '2620:0:863:101:10:128:0:21', '10.128.0.36', '2620:0:863:101:10:128:0:36', '10.128.0.24', '2620:0:863:101:10:128:0:24', '10.128.0.10', '2620:0:863:101:10:128:0:10', '10.128.0.37', '2620:0:863:101:10:128:0:37', '10.128.0.12', '2620:0:863:101:10:128:0:12', '10.132.0.17', '2001:df2:e500:101:10:132:0:17', '10.132.0.18', '2001:df2:e500:101:10:132:0:18', '10.132.0.19', '2001:df2:e500:101:10:132:0:19', '10.132.0.24', '2001:df2:e500:101:10:132:0:24', '10.132.0.29', '2001:df2:e500:101:10:132:0:29', '10.132.0.30', '2001:df2:e500:101:10:132:0:30', '10.132.0.34', '2001:df2:e500:101:10:132:0:34', '10.132.0.35', '2001:df2:e500:101:10:132:0:35', '10.132.0.36', '2001:df2:e500:101:10:132:0:36', '10.132.0.37', '2001:df2:e500:101:10:132:0:37', '10.132.0.38', '2001:df2:e500:101:10:132:0:38', '10.132.0.25', '2001:df2:e500:101:10:132:0:25', '10.132.0.26', '2001:df2:e500:101:10:132:0:26', '10.132.0.27', '2001:df2:e500:101:10:132:0:27', '10.132.0.28', '2001:df2:e500:101:10:132:0:28', '10.132.0.16', '2001:df2:e500:101:10:132:0:16', '10.136.0.6', '2a02:ec80:600:101:10:136:0:6', '10.136.1.6', '2a02:ec80:600:102:10:136:1:6', '10.136.0.7', '2a02:ec80:600:101:10:136:0:7', '10.136.1.7', '2a02:ec80:600:102:10:136:1:7', '10.136.0.8', '2a02:ec80:600:101:10:136:0:8', '10.136.1.8', '2a02:ec80:600:102:10:136:1:8', '10.136.0.9', '2a02:ec80:600:101:10:136:0:9', '10.136.1.9', '2a02:ec80:600:102:10:136:1:9', '10.136.0.10', '2a02:ec80:600:101:10:136:0:10', '10.136.1.10', '2a02:ec80:600:102:10:136:1:10', '10.136.0.11', '2a02:ec80:600:101:10:136:0:11', '10.136.1.11', '2a02:ec80:600:102:10:136:1:11', '10.136.0.12', '2a02:ec80:600:101:10:136:0:12', '10.136.1.12', '2a02:ec80:600:102:10:136:1:12', '10.136.0.13', '2a02:ec80:600:101:10:136:0:13', '10.136.1.13', '2a02:ec80:600:102:10:136:1:13', '10.140.0.3', '2a02:ec80:700:101:10:140:0:3', '10.140.1.4', '2a02:ec80:700:102:10:140:1:4', '10.140.0.4', '2a02:ec80:700:101:10:140:0:4', '10.140.1.5', '2a02:ec80:700:102:10:140:1:5', '10.140.0.5', '2a02:ec80:700:101:10:140:0:5', '10.140.1.6', '2a02:ec80:700:102:10:140:1:6', '10.140.0.6', '2a02:ec80:700:101:10:140:0:6', '10.140.1.7', '2a02:ec80:700:102:10:140:1:7', '10.140.0.7', '2a02:ec80:700:101:10:140:0:7', '10.140.1.8', '2a02:ec80:700:102:10:140:1:8', '10.140.0.8', '2a02:ec80:700:101:10:140:0:8', '10.140.1.9', '2a02:ec80:700:102:10:140:1:9', '10.140.0.9', '2a02:ec80:700:101:10:140:0:9', '10.140.1.10', '2a02:ec80:700:102:10:140:1:10', '10.140.0.10', '2a02:ec80:700:101:10:140:0:10', '10.140.1.11', '2a02:ec80:700:102:10:140:1:11']
  +    ensure => present
  

• Prometheus::Node_textfile[prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_front_proxy_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_kafka" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• Cfssl::Cert[OCSP_dse_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_dse_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_dse_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => dse
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@dse]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-dse]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft].orig
  +++ File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft.orig
  +++ /etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft
  @@ -0,0 +1,15 @@
  +# Autogenerated by puppet
  +set KAFKA_BROKERS_MAIN_ipv4 {
  +    type ipv4_addr
  +    elements = { 10.192.5.9,
  +             10.192.22.6,
  +             10.192.32.4,
  +             10.192.48.33,
  +             10.192.48.35,
  +             10.64.0.101,
  +             10.64.16.30,
  +             10.64.32.45,
  +             10.64.48.37,
  +             10.64.152.5
  +    }
  +}

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_syslog]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem

• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Cfssl::Cert[OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_aux_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => aux_front_proxy
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@aux_front_proxy]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• Service[nftables]

  Parameters differences:

  --- Service[nftables].orig
  +++ Service[nftables]
  
  +    ensure     => running
  +    enable     => True
  +    hasrestart => True
  +    restart    => /usr/bin/systemctl reload nftables
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_etcd command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_etcd
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "c834f873297e445663ead81279c0b928" --timeout 10 --check-command "check_check_certificate_expiry_etcd"

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_zuul]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_zuul].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_zuul]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_zuul.service
  

• Cfssl::Config[wikikube_front_proxy]

  Parameters differences:

  --- Cfssl::Config[wikikube_front_proxy].orig
  +++ Cfssl::Config[wikikube_front_proxy]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/wikikube_front_proxy/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/wikikube_front_proxy
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/wikikube_front_proxy
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages      => ['signing', 'key encipherment', 'client auth']
  

• File[/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• File[/etc/apache2/conf-enabled/50-cfssl-issuer-k8s-pods-vhost-port.conf]

  Parameters differences:

  --- File[/etc/apache2/conf-enabled/50-cfssl-issuer-k8s-pods-vhost-port.conf].orig
  +++ File[/etc/apache2/conf-enabled/50-cfssl-issuer-k8s-pods-vhost-port.conf]
  
  -    notify => Service[apache2]
  -    ensure => link
  -    target => /etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf
  -    owner  => root
  -    group  => root
  

• Systemd::Timer::Job[cfssl-ocsprefresh-syslog]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-syslog].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-syslog]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - syslog
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/syslog/ca/syslog.pem --responses-file /etc/cfssl/ocsp/syslog.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@syslog' syslog 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer
  

• Systemd::Unit[cfssl-ocspserve@puppet_rsa]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@puppet_rsa].orig
  +++ Systemd::Unit[cfssl-ocspserve@puppet_rsa]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@puppet_rsa
  

• Service[cfssl-ocspserve@dse_front_proxy]

  Parameters differences:

  --- Service[cfssl-ocspserve@dse_front_proxy].orig
  +++ Service[cfssl-ocspserve@dse_front_proxy]
  
  -    ensure => running
  -    enable => True
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Prometheus::Blackbox::Check::Http[PKI_discovery2026]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_discovery2026].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_discovery2026]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"discovery2026"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/lib/systemd/system/cfssl-ocspserve@discovery2026.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@discovery2026.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@discovery2026.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@discovery2026.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@discovery2026.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (discovery2026)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 10010 \
  -          -responses /etc/cfssl/ocsp/discovery2026.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_wikikube_staging" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• File[/usr/local/bin/prometheus-check-debmonitor-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-debmonitor-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-debmonitor-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Exec[renew certificate - OCSP_discovery_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_discovery_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_discovery_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/nftables/postrouting]

  Parameters differences:

  --- File[/etc/nftables/postrouting].orig
  +++ File[/etc/nftables/postrouting]
  
  +    ensure  => directory
  +    purge   => True
  +    recurse => True
  +    owner   => root
  +    group   => root
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_dse_front_proxy_2560f4f577ba169af651cf96bd5dc1ba]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_dse_front_proxy_2560f4f577ba169af651cf96bd5dc1ba].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_dse_front_proxy_2560f4f577ba169af651cf96bd5dc1ba]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: dse_front_proxy
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="2560f4f577ba169af651cf96bd5dc1ba",check_name="check_check_certificate_expiry_dse_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__dse_front_proxy
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: dse_front_proxy
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_dse_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.service (prometheus-node-textfile-check-nft.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.service (prometheus-node-textfile-check-nft.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.service (prometheus-node-textfile-check-nft.service)]
  
  +    command     => /bin/systemctl daemon-reload
  +    refreshonly => True
  

• Logrotate::Conf[cfssl-ocsprefresh-mlserve]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-mlserve].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-mlserve]
  
  -    ensure => present
  

• Exec[Generate initial CRL for debmonitor]

  Parameters differences:

  --- Exec[Generate initial CRL for debmonitor].orig
  +++ Exec[Generate initial CRL for debmonitor]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/debmonitor/ca/debmonitor.pem /etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/debmonitor
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/debmonitor
  

• Cfssl::Cert[OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => cloud_wmnet_ca
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@cloud_wmnet_ca]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-etcd-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-etcd-certificate-expiry --cert-path /etc/cfssl/signers/etcd/ca/etcd.pem --outfile /var/lib/prometheus/node.d/etcd_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Service[cfssl-ocspserve@mlserve]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@mlserve].orig
  +++ Systemd::Service[cfssl-ocspserve@mlserve]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft
  @@ -0,0 +1,9 @@
  +# Autogenerated by puppet
  +set STAGING_KUBEPODS_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 10.64.64.0/21,
  +             10.192.64.0/21
  +    }
  +}

• Service[cfssl-ocsprefresh-aux_front_proxy.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-aux_front_proxy.timer].orig
  +++ Service[cfssl-ocsprefresh-aux_front_proxy.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Cfssl::Ocsp[discovery]

  Parameters differences:

  --- Cfssl::Ocsp[discovery].orig
  +++ Cfssl::Ocsp[discovery]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/discovery/ca/discovery.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 10002
  -    db_driver          => mysql
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Nftables::Set[PROMETHEUS_HOSTS]

  Parameters differences:

  --- Nftables::Set[PROMETHEUS_HOSTS].orig
  +++ Nftables::Set[PROMETHEUS_HOSTS]
  
  +    hosts  => ['prometheus1005.eqiad.wmnet', 'prometheus1006.eqiad.wmnet', 'prometheus1007.eqiad.wmnet', 'prometheus1008.eqiad.wmnet']
  +    ensure => present
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_front_proxy_b194b5b9b6c9d6e05b9eed8dcfcc40cf]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_front_proxy_b194b5b9b6c9d6e05b9eed8dcfcc40cf].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_front_proxy_b194b5b9b6c9d6e05b9eed8dcfcc40cf]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="b194b5b9b6c9d6e05b9eed8dcfcc40cf",check_name="check_check_certificate_expiry_mlserve_staging_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__mlserve_staging_front_proxy
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_mlserve_staging_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• File[/lib/systemd/system/cfssl-ocsprefresh-aux.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-aux.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-aux.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-aux.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-aux.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-aux.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-aux.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/lib/systemd/system/prometheus-node-textfile-check-nft.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-check-nft.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-check-nft.timer]
  
  +    notify => Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.timer (prometheus-node-textfile-check-nft.timer)]
  +    ensure => present
  +    owner  => root
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-check-nft.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-check-nft.timer
  @@ -0,0 +1,12 @@
  +[Unit]
  +Description=Periodic execution of prometheus-node-textfile-check-nft.service
  +
  +[Timer]
  +Unit=prometheus-node-textfile-check-nft.service
  +# Accuracy sets the maximum time interval around the execution time we want to allow
  +AccuracySec=15sec
  +OnCalendar=*:0/30
  +RandomizedDelaySec=0
  +
  +[Install]
  +WantedBy=multi-user.target

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-puppet_rsa
  -
  -/var/log/cfssl-ocsprefresh-puppet_rsa/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Package[python3-pymysql]

  Parameters differences:

  --- Package[python3-pymysql].orig
  +++ Package[python3-pymysql]
  
  -    provider => apt
  -    ensure   => installed
  

• File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_cfssl-multirootca_status command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_cfssl-multirootca_status
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "52832284a5fb8b8ea6f55bb6271912c9" --timeout 10 --check-command "check_check_cfssl-multirootca_status" --page

• Systemd::Timer[cfssl-ocsprefresh-network_devices]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-network_devices].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-network_devices]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-network_devices.service
  

• Ferm::Conf[defs]

  Parameters differences:

  --- Ferm::Conf[defs].orig
  +++ Ferm::Conf[defs]
  
  -    prio   => 00
  -    ensure => present
  

• Cfssl::Config[puppet_rsa]

  Parameters differences:

  --- Cfssl::Config[puppet_rsa].orig
  +++ Cfssl::Config[puppet_rsa]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/puppet_rsa/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/puppet_rsa
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/puppet_rsa
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'mtls': {'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages      => ['digital signature', 'key encipherment', 'server auth']
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_front_proxy_4d759acaf0fd7dd3abaa03dc4565aef6]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_front_proxy_4d759acaf0fd7dd3abaa03dc4565aef6].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_front_proxy_4d759acaf0fd7dd3abaa03dc4565aef6]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_front_proxy
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="4d759acaf0fd7dd3abaa03dc4565aef6",check_name="check_check_certificate_expiry_wikikube_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__wikikube_front_proxy
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_front_proxy
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_wikikube_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - dse_front_proxy
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --responses-file /etc/cfssl/ocsp/dse_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@dse_front_proxy' dse_front_proxy 

• Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@mlserve_staging]']
  -    refreshonly => True
  

• Class[Httpd]

  Parameters differences:

  --- Class[Httpd].orig
  +++ Class[Httpd]
  
  -    legacy_compat        => present
  -    period               => daily
  -    purge_manual_config  => True
  -    remove_default_ports => False
  -    http_only            => False
  -    modules              => ['proxy_http', 'ssl', 'headers']
  -    wait_network_online  => False
  -    extra_pkgs           => []
  -    rotate               => 30
  -    enable_forensic_log  => False
  

• Httpd::Conf[server-status]

  Parameters differences:

  --- Httpd::Conf[server-status].orig
  +++ Httpd::Conf[server-status]
  
  -    require   => Httpd::Mod_conf[status]
  -    conf_type => conf
  -    ensure    => present
  -    priority  => 50
  -    source    => puppet:///modules/httpd/status.conf
  

• Cfssl::Ocsp[mlserve_front_proxy]

  Parameters differences:

  --- Cfssl::Ocsp[mlserve_front_proxy].orig
  +++ Cfssl::Ocsp[mlserve_front_proxy]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 20031
  -    db_driver          => mysql
  

• Systemd::Service[cfssl-ocsprefresh-wikikube_staging]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-wikikube_staging].orig
  +++ Systemd::Service[cfssl-ocsprefresh-wikikube_staging]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft
  @@ -0,0 +1,9 @@
  +# Autogenerated by puppet
  +set DSE_KUBEPODS_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2620:0:861:302::/64,
  +             2620:0:860:308::/64
  +    }
  +}

• Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Nftables::File[base]

  Parameters differences:

  --- Nftables::File[base].orig
  +++ Nftables::File[base]
  
  +    order  => 100
  +    ensure => present
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Nftables::Set[NETWORK_INFRA]

  Parameters differences:

  --- Nftables::Set[NETWORK_INFRA].orig
  +++ Nftables::Set[NETWORK_INFRA]
  
  +    hosts  => ['185.15.59.128/27', '2a02:ec80:300:fe00::/55', '198.35.26.128/27', '2620:0:863:fe00::/55', '208.80.153.192/27', '2620:0:860:fe00::/55', '10.192.255.0/24', '2620:0:860:13f::/64', '10.192.253.0/24', '2620:0:860:139::/64', '208.80.154.192/27', '2620:0:861:fe00::/55', '10.64.146.0/24', '2620:0:861:11b::/128', '10.64.168.0/24', '2620:0:861:130::/64', '10.64.147.0/24', '103.102.166.128/27', '2001:df2:e500:fe00::/55', '185.15.58.128/27', '2a02:ec80:600:fe00::/55', '195.200.68.128/27', '2a02:ec80:700:fe00::/55']
  +    ensure => present
  

• Motd::Message[pki::multirootca]

  Parameters differences:

  --- Motd::Message[pki::multirootca].orig
  +++ Motd::Message[pki::multirootca]
  
  -    priority => 5
  -    message  => pki1001 is a PKI server (pki::multirootca)
  -    ensure   => present
  

• Exec[update_alternative_ip6tables]

  Parameters differences:

  --- Exec[update_alternative_ip6tables].orig
  +++ Exec[update_alternative_ip6tables]
  
  -    command => /usr/bin/update-alternatives --force --set ip6tables /usr/sbin/ip6tables-legacy
  -    unless  => /usr/bin/update-alternatives --query ip6tables | /bin/grep 'Value: /usr/sbin/ip6tables-legacy'
  

• Cfssl::Ocsp[wikikube]

  Parameters differences:

  --- Cfssl::Ocsp[wikikube].orig
  +++ Cfssl::Ocsp[wikikube]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/wikikube/ca/wikikube.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 20010
  -    db_driver          => mysql
  

• File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem].orig
  +++ File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem.orig
  +++ /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem
  @@ -1 +0,0 @@
  -nosecret

• File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft].orig
  +++ File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft.orig
  +++ /etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft
  @@ -0,0 +1,14 @@
  +# Autogenerated by puppet
  +set KAFKA_BROKERS_JUMBO_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:109:10:64:130:10,
  +             2620:0:861:10a:10:64:131:16,
  +             2620:0:861:10b:10:64:132:21,
  +             2620:0:861:10d:10:64:134:9,
  +             2620:0:861:10e:10:64:135:16,
  +             2620:0:861:10f:10:64:136:11,
  +             2620:0:861:122:10:64:154:15,
  +             2620:0:861:128:10:64:160:16,
  +             2620:0:861:101:10:64:0:126
  +    }
  +}

• Systemd::Unit[prometheus-node-textfile-check-nft.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-check-nft.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-check-nft.service]
  
  +    require           => ['Class[Systemd]']
  +    override_filename => puppet-override.conf
  +    ensure            => present
  +    override          => False
  +    restart           => False
  +    unit              => prometheus-node-textfile-check-nft.service
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem

• File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft
  @@ -0,0 +1,12 @@
  +# Autogenerated by puppet
  +set CLOUD_PRIVATE_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 172.20.1.0/24,
  +             172.20.2.0/24,
  +             172.20.3.0/24,
  +             172.20.4.0/24,
  +             172.20.5.0/24
  +    }
  +}

• File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Alternatives::Select[iptables]

  Parameters differences:

  --- Alternatives::Select[iptables].orig
  +++ Alternatives::Select[iptables]
  
  -    require => Package[iptables]
  -    path    => /usr/sbin/iptables-legacy
  

• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• File[/lib/systemd/system/cfssl-ocsprefresh-dse.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-dse.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-dse.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-dse.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-dse.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - dse
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/dse/ca/dse.pem --responses-file /etc/cfssl/ocsp/dse.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@dse' dse 

• File[/etc/nftables/input/10_ssh-from-cumin-masters.nft]

  Parameters differences:

  --- File[/etc/nftables/input/10_ssh-from-cumin-masters.nft].orig
  +++ File[/etc/nftables/input/10_ssh-from-cumin-masters.nft]
  
  +    notify  => ['Service[nftables]']
  +    require => ['Nftables::Set[CUMIN_MASTERS]']
  +    ensure  => present
  +    owner   => root
  +    tag     => nft
  +    mode    => 0444
  +    group   => root
  

  Content differences:

  --- /etc/nftables/input/10_ssh-from-cumin-masters.nft.orig
  +++ /etc/nftables/input/10_ssh-from-cumin-masters.nft
  @@ -0,0 +1,4 @@
  +# Managed by puppet
  +# 
  +ip saddr @CUMIN_MASTERS_ipv4 tcp dport { 22 } accept
  +ip6 saddr @CUMIN_MASTERS_ipv6 tcp dport { 22 } accept

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_debmonitor.service
  

• Ferm::Rule[log-everything]

  Parameters differences:

  --- Ferm::Rule[log-everything].orig
  +++ Ferm::Rule[log-everything]
  
  -    ensure => present
  -    rule   => NFLOG mod limit limit 1/second limit-burst 5 nflog-prefix "[fw-in-drop]";
  -    chain  => INPUT
  -    prio   => 98
  -    table  => filter
  -    desc   => 
  -    domain => (ip ip6)
  

• Profile::Pki::Multirootca::Monitoring[mlserve_front_proxy]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[mlserve_front_proxy].orig
  +++ Profile::Pki::Multirootca::Monitoring[mlserve_front_proxy]
  
  -    intermediate => mlserve_front_proxy
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
  

• Service[cfssl-ocsprefresh-debmonitor.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-debmonitor.timer].orig
  +++ Service[cfssl-ocsprefresh-debmonitor.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "bfd2f7c6497e1da6323bef48d24f9e8e" --timeout 10 --check-command "check_check_certificate_expiry_mlserve"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_mlserve
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging -profile ocsp /etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• Service[cfssl-gc-expired-certs.timer]

  Parameters differences:

  --- Service[cfssl-gc-expired-certs.timer].orig
  +++ Service[cfssl-gc-expired-certs.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-kafka" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-kafka/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]

  Parameters differences:

  --- Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)].orig
  +++ Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Profile::Auto_restarts::Service[apache-htcacheclean]

  Parameters differences:

  --- Profile::Auto_restarts::Service[apache-htcacheclean].orig
  +++ Profile::Auto_restarts::Service[apache-htcacheclean]
  
  -    ensure => absent
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
  

• File[/etc/logrotate.d/wmf_auto_restart_apache2]

  Parameters differences:

  --- File[/etc/logrotate.d/wmf_auto_restart_apache2].orig
  +++ File[/etc/logrotate.d/wmf_auto_restart_apache2]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/wmf_auto_restart_apache2.orig
  +++ /etc/logrotate.d/wmf_auto_restart_apache2
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for wmf_auto_restart_apache2
  -
  -/var/log/wmf_auto_restart_apache2/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_bfd2f7c6497e1da6323bef48d24f9e8e]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_bfd2f7c6497e1da6323bef48d24f9e8e].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_bfd2f7c6497e1da6323bef48d24f9e8e]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="bfd2f7c6497e1da6323bef48d24f9e8e",check_name="check_check_certificate_expiry_mlserve", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__mlserve
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_mlserve))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
  

• Service[cfssl-ocspserve@wikikube_staging_front_proxy]

  Parameters differences:

  --- Service[cfssl-ocspserve@wikikube_staging_front_proxy].orig
  +++ Service[cfssl-ocspserve@wikikube_staging_front_proxy]
  
  -    ensure => running
  -    enable => True
  

• Sudo::User[nrpe-check_check_certificate_expiry_wikikube]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_wikikube].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_wikikube]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem']
  -    tag        => nrpe::check
  

• Rsyslog::Conf[cfssl-ocsprefresh-wikikube_front_proxy]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-wikikube_front_proxy].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-wikikube_front_proxy]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy]
  -    ensure   => present
  -    mode     => 0444
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_mlserve
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "bfd2f7c6497e1da6323bef48d24f9e8e" --timeout 10 --check-command "check_check_certificate_expiry_mlserve"

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Cfssl::Config[cloud_wmnet_ca]

  Parameters differences:

  --- Cfssl::Config[cloud_wmnet_ca].orig
  +++ Cfssl::Config[cloud_wmnet_ca]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/cloud_wmnet_ca
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/cloud_wmnet_ca
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages      => ['digital signature', 'key encipherment', 'server auth']
  

• File[/etc/cfssl/signers/syslog/ca/syslog.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/syslog/ca/syslog.pem].orig
  +++ File[/etc/cfssl/signers/syslog/ca/syslog.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/syslog/ca/syslog.pem.orig
  +++ /etc/cfssl/signers/syslog/ca/syslog.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDqTCCAwqgAwIBAgIUI5/ixOCtnw8ZXV6xWw6RVC/D6rwwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwOTI4MTAzNzAwWhcNMjgwOTI2MTAzNzAwWjB0
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMQ8wDQYDVQQDEwZzeXNsb2cwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABL
  -CaZwsDnVcBhApShaeA1j8/9w4S2re0Zmjx7GTeBXiJcKF0dAhgAQRCMrGtWEimmQ
  -W94s5015H1MknO61lLOY+wDAFYkq98rZF2aRRILm1w/5iRkqTDiBECBVE15jrPzD
  -q4zZCQ5V5ellWhzfGfPMxFOogIm1sqZsqZvB7zZaCSOrbaOCAQwwggEIMA4GA1Ud
  -DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRvwMc33QVQ
  -qaT1dZmUUtkBeYiyzjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBW
  -BggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5
  -LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMw
  -QTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRp
  -YV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAUtK7APyQamN
  -8DYOBCd1wJQ1DbYlzcQOcupJns2RKKcxFp1evo2GQjDA15TN1OXtA+pvK/liCAEh
  -p828+NcE6fPMAkIBN/Yjhvy0lrtVzshqckUEciShFhbDU0QZOHuzIXCVjdskzQfu
  -as4ZMO15kIv0MZUJ6V9aKEE6nqzi9QXifjuoY54=
  ------END CERTIFICATE-----

• File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - Wikimedia_Internal_Root_CA
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem --responses-file /etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@Wikimedia_Internal_Root_CA' Wikimedia_Internal_Root_CA 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Cfssl::Ocsp[mlserve_staging_front_proxy]

  Parameters differences:

  --- Cfssl::Ocsp[mlserve_staging_front_proxy].orig
  +++ Cfssl::Ocsp[mlserve_staging_front_proxy]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 20041
  -    db_driver          => mysql
  

• Logrotate::Conf[wmf_auto_restart_ulogd2]

  Parameters differences:

  --- Logrotate::Conf[wmf_auto_restart_ulogd2].orig
  +++ Logrotate::Conf[wmf_auto_restart_ulogd2]
  
  -    ensure => present
  

• Profile::Pki::Multirootca::Monitoring[discovery2026]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[discovery2026].orig
  +++ Profile::Pki::Multirootca::Monitoring[discovery2026]
  
  -    intermediate => discovery2026
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
  

• Prometheus::Blackbox::Check::Http[PKI_dse]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_dse].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_dse]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"dse"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-wikikube_staging_front_proxy.timer
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-etcd" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-etcd/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Ferm::Service[multirootca_tls_termination_for_cfssl_issuer_k8s_pods]

  Parameters differences:

  --- Ferm::Service[multirootca_tls_termination_for_cfssl_issuer_k8s_pods].orig
  +++ Ferm::Service[multirootca_tls_termination_for_cfssl_issuer_k8s_pods]
  
  -    ensure              => present
  -    port                => 8443
  -    prio                => 10
  -    desc                => 
  -    src_sets            => ['WIKIKUBE_KUBEPODS_NETWORKS', 'STAGING_KUBEPODS_NETWORKS', 'MLSERVE_KUBEPODS_NETWORKS', 'MLSTAGE_KUBEPODS_NETWORKS', 'DSE_KUBEPODS_NETWORKS', 'AUX_KUBEPODS_NETWORKS']
  -    proto               => tcp
  -    unrestricted_access => False
  -    notrack             => False
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]']
  -    refreshonly => True
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_etcd]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_etcd].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_etcd]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Cfssl::Ocsp[debmonitor]

  Parameters differences:

  --- Cfssl::Ocsp[debmonitor].orig
  +++ Cfssl::Ocsp[debmonitor]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 10001
  -    db_driver          => mysql
  

• Systemd::Unit[cfssl-ocspserve@aux]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@aux].orig
  +++ Systemd::Unit[cfssl-ocspserve@aux]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@aux
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_staging_front_proxy command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "b194b5b9b6c9d6e05b9eed8dcfcc40cf" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_staging_front_proxy"

• Systemd::Service[cfssl-ocsprefresh-cassandra]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-cassandra].orig
  +++ Systemd::Service[cfssl-ocsprefresh-cassandra]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-cassandra.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-Wikimedia_Internal_Root_CA" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]']
  -    refreshonly => True
  

• File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem].orig
  +++ File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem.orig
  +++ /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDsTCCAxSgAwIBAgIUKJGxrsUkuGnKTwrJIdYlm1ZK6uMwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB+
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRkwFwYDVQQDDBB3aWtpa3ViZV9zdGFnaW5nMIGbMBAGByqGSM49AgEGBSuB
  -BAAjA4GGAAQBJQPiRDYxLnr33KdzugCHk21yjDhyRHMrAIJ0qGmasdcMNZpK9P9u
  -6ISJRfTC73WiKOSSWBuJAhsdK2Y7hIoUOikAexL5MOVOFAK8MtWXx6j7MmuuPGnC
  -MIyIk1pqxzoacZWJ8uJe/WGw/Udd/RPxAfsxN8loKKT0+zs3WzGw63saO6yjggEM
  -MIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4E
  -FgQU8bcT1hszDpGqcobdFXNOugsbu0MwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81
  -cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtp
  -LmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NB
  -MEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2Ny
  -bC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYC
  -QTKbWZ4u9V6ei9rgB4XXyyVEzIZMgVCdwuytcmqEaB9ZavqjYsdrgTOsgcy2Jw1C
  -id1Sw/9g5YpcZBLaXh52CuNVAkFnnXo7+fe5kgOs2vTIsbIG4huh6ftI/8bmIdr2
  -9FHm9FXlmSIDWQIn7Fq4TFLVmiatI/TdiGK+n3oT/st73jwn1A==
  ------END CERTIFICATE-----

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-discovery2026-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-discovery2026-certificate-expiry --cert-path /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --outfile /var/lib/prometheus/node.d/discovery2026_intermediate.prom

• Systemd::Unit[cfssl-ocspserve@dse]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@dse].orig
  +++ Systemd::Unit[cfssl-ocspserve@dse]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@dse
  

• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/etc/nftables/sets/INTERNAL_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/INTERNAL_ipv4.nft].orig
  +++ File[/etc/nftables/sets/INTERNAL_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/INTERNAL_ipv4.nft.orig
  +++ /etc/nftables/sets/INTERNAL_ipv4.nft
  @@ -0,0 +1,8 @@
  +# Autogenerated by puppet
  +set INTERNAL_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 10.0.0.0/8
  +    }
  +}

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
  
  -    ensure => present
  

• File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft.orig
  +++ /etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft
  @@ -0,0 +1,12 @@
  +# Autogenerated by puppet
  +set MYSQL_ROOT_CLIENTS_ipv4 {
  +    type ipv4_addr
  +    elements = { 10.64.16.90,
  +             10.192.16.191,
  +             10.64.16.154,
  +             10.192.32.49,
  +             208.80.155.103,
  +             208.80.154.9,
  +             10.64.0.20
  +    }
  +}

• Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-discovery.timer]']
  -    refreshonly => True
  

• File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem].orig
  +++ File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem.orig
  +++ /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem
  @@ -1 +0,0 @@
  -fake

• Systemd::Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Unit[cfssl-ocspserve@wikikube_staging_front_proxy]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@wikikube_staging_front_proxy].orig
  +++ Systemd::Unit[cfssl-ocspserve@wikikube_staging_front_proxy]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@wikikube_staging_front_proxy
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_etcd]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_etcd].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_etcd]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: etcd
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_etcd!10
  

• Logrotate::Conf[cfssl-ocsprefresh-dse_front_proxy]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-dse_front_proxy].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-dse_front_proxy]
  
  -    ensure => present
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]']
  -    refreshonly => True
  

• File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/FRACK_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/FRACK_NETWORKS_ipv4.nft
  @@ -0,0 +1,22 @@
  +# Autogenerated by puppet
  +set FRACK_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 10.195.0.0/27,
  +             10.195.0.128/29,
  +             10.195.0.32/27,
  +             10.195.0.64/28,
  +             10.195.0.80/29,
  +             10.195.0.96/27,
  +             10.195.1.0/25,
  +             10.64.40.0/27,
  +             10.64.40.160/27,
  +             10.64.40.192/26,
  +             10.64.40.32/27,
  +             10.64.40.64/27,
  +             10.64.40.96/27,
  +             208.80.152.224/28,
  +             208.80.155.0/27
  +    }
  +}

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• Cfssl::Signer[debmonitor]

  Parameters differences:

  --- Cfssl::Signer[debmonitor].orig
  +++ Cfssl::Signer[debmonitor]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDqzCCAw6gAwIBAgIUD8gl+8iTKG2ZJ9eRsZs5/C9/7ZMwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMzE0MTM0NTAwWhcNMjgwMzEyMTM0NTAwWjB4
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMRMwEQYDVQQDEwpkZWJtb25pdG9yMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
  AAQBNH4qwApzKzoZpcUF5+rzNhzi2ETF1ToNoWJ4XIJH/PmYzcXmDj41+b+4p4++
  M+ENQtHt6dfCVv0BmGr8XYTU3YUAQUiLhv/X41GLwCV4Nx5jsnpnlfyi2tfXY2b1
  WgpdkxBTQi79fWYWJFvuy7AFhP0ahKcKfauegEHf1zJ/j7pKyjSjggEMMIIBCDAO
  BgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU35FY
  TrdI8tZ8bKAVj8qkrn5sp9QwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9p
  EzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2Nv
  dmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1Ud
  HwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtp
  bWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYCQXXZh0fs
  XIlOkz1OPSSRBbEZ6zjvGEJvR6qPVpdkQ8IY+bwqe6J/wrhlAgWfTq7ODhEQYCnx
  y9Jdg7TfybUaOnmiAkEGKMoHIi/MXfzVrKicaCo4aHIL14vN3V4go08bIsMuIs7p
  EknA+x7QLKFunnrATNeeF6ETr+3u9/MUDWGW+fBqEw==
  -----END CERTIFICATE-----
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => ##### FAKE FOR PUPPET ######
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/debmonitor
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/debmonitor
  -    ca_key_file      => /etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages   => ['signing', 'key encipherment', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Nrpe::Monitor_service[check_certificate_expiry_aux_front_proxy]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_aux_front_proxy].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_aux_front_proxy]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: aux_front_proxy
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
  -    timeout                     => 10
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Service[cfssl-ocspserve@etcd]

  Parameters differences:

  --- Service[cfssl-ocspserve@etcd].orig
  +++ Service[cfssl-ocspserve@etcd]
  
  -    ensure => running
  -    enable => True
  

• Systemd::Unit[cfssl-ocsprefresh-kafka.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-kafka.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-kafka.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-kafka.service
  

• Profile::Pki::Multirootca::Monitoring[aux_front_proxy]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[aux_front_proxy].orig
  +++ Profile::Pki::Multirootca::Monitoring[aux_front_proxy]
  
  -    intermediate => aux_front_proxy
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
  

• Sudo::User[nrpe-check_check_certificate_expiry_aux_front_proxy]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_aux_front_proxy].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_aux_front_proxy]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem']
  -    tag        => nrpe::check
  

• Systemd::Unit[cfssl-ocsprefresh-cassandra.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-cassandra.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-cassandra.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-cassandra.timer
  

• Profile::Pki::Multirootca::Monitoring[debmonitor]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[debmonitor].orig
  +++ Profile::Pki::Multirootca::Monitoring[debmonitor]
  
  -    intermediate => debmonitor
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
  

• File[/var/log/cfssl-ocsprefresh-kafka]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-kafka].orig
  +++ File[/var/log/cfssl-ocsprefresh-kafka]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_kafka]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_kafka].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_kafka]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/cfssl/signers/etcd/ca/etcd.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/etcd/ca/etcd.pem].orig
  +++ File[/etc/cfssl/signers/etcd/ca/etcd.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/etcd/ca/etcd.pem.orig
  +++ /etc/cfssl/signers/etcd/ca/etcd.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDpzCCAwigAwIBAgIUOk3cFWirYBfYaO6q8zyqfEHxwVEwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjIwODEwMTAzODAwWhcNMjcwODA5MTAzODAwWjBy
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMQ0wCwYDVQQDEwRldGNkMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAgtdp
  -7nZHIAQhEm2IlJ7AzfGjWIGGzKzCfnBQ8d+euPiOZ3ccv1YXfx0f+WmV35vuEmA/
  -ZSw/6iJrKBnYsZAR6U0ByUUqg6nUYg4P47Sc/kMTWmVIgRuNhmrgavCK+qRQdnZs
  -N/OOGTgFNG0icty63dUF4NZz80HxHSrPQYaNxZ9ydY2jggEMMIIBCDAOBgNVHQ8B
  -Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUtvZYHyYnZHZP
  -ZLIB5kqPcVOVI9owHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
  -KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
  -bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
  -P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
  -SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgEgYyeOREniK9JC
  -4hvIiuv9D7mVVXzX5/s8GuhTbRadqZr41ulpHT53lFcbt+xhAsyqMxXPhgT/OyMQ
  -jkXuEh5oBQJCAM22xLZpt2XwKCp0opgXlC5fm5+YjKba2COlr43q78I2la57aYdp
  -UF7sFgBRFVx7FNY7CASuZMYsW+4wltPTXVau
  ------END CERTIFICATE-----

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_syslog" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-discovery.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-discovery.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-discovery.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-discovery.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Logrotate::Conf[cfssl-ocsprefresh-cassandra]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-cassandra].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-cassandra]
  
  -    ensure => present
  

• File[/lib/systemd/system/cfssl-ocspserve@discovery.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@discovery.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@discovery.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@discovery.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@discovery.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (discovery)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 10002 \
  -          -responses /etc/cfssl/ocsp/discovery.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
  

• Logrotate::Conf[cfssl-ocsprefresh-wikikube_front_proxy]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-wikikube_front_proxy].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-wikikube_front_proxy]
  
  -    ensure => present
  

• Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@cassandra]']
  -    refreshonly => True
  

• Concat_fragment[main]

  Content differences:

  --- main.orig
  +++ main
  @@ -14,7 +14,6 @@
   [agent]
   use_srv_records = true
   srv_domain = eqiad.wmnet
  -dns_alt_names = pki.discovery.wmnet
   daemonize = false
   http_connect_timeout = 60
   http_read_timeout = 960

• Cfssl::Config[network_devices]

  Parameters differences:

  --- Cfssl::Config[network_devices].orig
  +++ Cfssl::Config[network_devices]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/network_devices/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 8760h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/network_devices
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/network_devices
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages      => ['digital signature', 'key encipherment', 'server auth']
  

• File[/etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf].orig
  +++ File[/etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf.orig
  +++ /etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "wmf_auto_restart_apache-htcacheclean" then {
  -    action(
  -        type="omfile" file="/var/log/wmf_auto_restart_apache-htcacheclean/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Systemd::Timer[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-discovery]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-discovery].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-discovery]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-discovery.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-discovery
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-discovery
  -
  -/var/log/cfssl-ocsprefresh-discovery/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Nrpe::Check[check_check_certificate_expiry_mlserve_staging_front_proxy]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_mlserve_staging_front_proxy].orig
  +++ Nrpe::Check[check_check_certificate_expiry_mlserve_staging_front_proxy]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
  -    before    => Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy]
  -    ensure    => present
  -    sudo_user => root
  

• Monitoring::Service[check_certificate_expiry_etcd]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_etcd].orig
  +++ Monitoring::Service[check_certificate_expiry_etcd]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: etcd
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_etcd!10
  

• File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Sudo::User[nrpe_certificate_check_kafka]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_kafka].orig
  +++ Sudo::User[nrpe_certificate_check_kafka]
  
  -    user       => nrpe_certificate_check_kafka
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-syslog.timer]']
  -    refreshonly => True
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_cassandra]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_cassandra].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_cassandra]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/srv/cfssl/bundles/debmonitor.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/debmonitor.pem].orig
  +++ File[/srv/cfssl/bundles/debmonitor.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/debmonitor.pem.orig
  +++ /srv/cfssl/bundles/debmonitor.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDqzCCAw6gAwIBAgIUD8gl+8iTKG2ZJ9eRsZs5/C9/7ZMwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMzE0MTM0NTAwWhcNMjgwMzEyMTM0NTAwWjB4
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRMwEQYDVQQDEwpkZWJtb25pdG9yMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
  -AAQBNH4qwApzKzoZpcUF5+rzNhzi2ETF1ToNoWJ4XIJH/PmYzcXmDj41+b+4p4++
  -M+ENQtHt6dfCVv0BmGr8XYTU3YUAQUiLhv/X41GLwCV4Nx5jsnpnlfyi2tfXY2b1
  -WgpdkxBTQi79fWYWJFvuy7AFhP0ahKcKfauegEHf1zJ/j7pKyjSjggEMMIIBCDAO
  -BgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU35FY
  -TrdI8tZ8bKAVj8qkrn5sp9QwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9p
  -EzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2Nv
  -dmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1Ud
  -HwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtp
  -bWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYCQXXZh0fs
  -XIlOkz1OPSSRBbEZ6zjvGEJvR6qPVpdkQ8IY+bwqe6J/wrhlAgWfTq7ODhEQYCnx
  -y9Jdg7TfybUaOnmiAkEGKMoHIi/MXfzVrKicaCo4aHIL14vN3V4go08bIsMuIs7p
  -EknA+x7QLKFunnrATNeeF6ETr+3u9/MUDWGW+fBqEw==
  ------END CERTIFICATE-----

• File[/etc/sudoers.d/nrpe_certificate_check_aux]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_aux].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_aux]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]']
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_dse.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_dse.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/srv/cfssl/bundles/discovery2026.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/discovery2026.pem].orig
  +++ File[/srv/cfssl/bundles/discovery2026.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/discovery2026.pem.orig
  +++ /srv/cfssl/bundles/discovery2026.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDrzCCAxGgAwIBAgIUa46nWae1FhV+WZzdsRMJchzTP54wCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjYwNDIwMTUzNjAwWhcNMzEwNDE5MTUzNjAwWjB7
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRYwFAYDVQQDEw1kaXNjb3ZlcnkyMDI2MIGbMBAGByqGSM49AgEGBSuBBAAj
  -A4GGAAQBNeE+xxvbq00KO92aWhHFTLosZBkXul9ufZINtOUd90TXpQnJvpEv7kK8
  -HQpufac9Dez+MBhLzQXoTY+ElhRCsQQBwlu+rIeqpbJEh87DQ2RTfzhTJmlm/9de
  -1fiM38/51DacwYS/vW0psN/lKSoM7cX/Paw6Qg7pBUmUGCq2vE9wDbmjggEMMIIB
  -CDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU
  -SXZcMeXrgnEYbZ3z1m8j/+8XmugwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR
  -0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRp
  -c2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoG
  -A1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9X
  -aWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQgD4
  -UGn506FGvacDvYS6t8JEMo6YH7jxK8dKeiZNEnhG5FSjA4Lt2BCz85sOBczxSD9h
  -b9wLCxy5wOpifRePlyrZQgJBNKUXBImWpyoHmt6hNOA6X7+FmGl0tD5tLnbeuPx7
  -aTlv8rfJ0d7JdsZXx+7M6YcsmxMgZCKUh4UMYu/WcczIq30=
  ------END CERTIFICATE-----

• File[/etc/cfssl/ocsp/network_devices.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/network_devices.ocsp].orig
  +++ File[/etc/cfssl/ocsp/network_devices.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery -profile ocsp /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-zuul" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-zuul/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-network_devices.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-network_devices.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - network_devices
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/network_devices/ca/network_devices.pem --responses-file /etc/cfssl/ocsp/network_devices.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@network_devices' network_devices 

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/signers/cloud_wmnet_ca/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/cloud_wmnet_ca/ca].orig
  +++ File[/etc/cfssl/signers/cloud_wmnet_ca/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Monitoring::Service[check_certificate_expiry_dse]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_dse].orig
  +++ Monitoring::Service[check_certificate_expiry_dse]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: dse
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_dse!10
  

• File[/etc/apache2/sites-available/00-dummy.conf]

  Parameters differences:

  --- File[/etc/apache2/sites-available/00-dummy.conf].orig
  +++ File[/etc/apache2/sites-available/00-dummy.conf]
  
  -    notify => Service[apache2]
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/httpd/dummy.conf
  -    mode   => 0444
  -    group  => root
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer
  

• Systemd::Timer[cfssl-ocsprefresh-dse]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-dse].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-dse]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-dse.service
  

• Nrpe::Check[check_check_certificate_expiry_mlserve_front_proxy]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_mlserve_front_proxy].orig
  +++ Nrpe::Check[check_check_certificate_expiry_mlserve_front_proxy]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
  -    before    => Monitoring::Service[check_certificate_expiry_mlserve_front_proxy]
  -    ensure    => present
  -    sudo_user => root
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@mlserve_staging_front_proxy]']
  -    refreshonly => True
  

• File_line[auto_restart_file_presence_apache2]

  Parameters differences:

  --- File_line[auto_restart_file_presence_apache2].orig
  +++ File_line[auto_restart_file_presence_apache2]
  
  -    require => File[/etc/debdeploy-client/autorestarts.conf]
  -    path    => /etc/debdeploy-client/autorestarts.conf
  -    ensure  => present
  -    line    => apache2
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_discovery2026.service
  

• File[/etc/cfssl/signers/mlserve_staging/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_staging/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/mlserve_staging/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/mlserve_staging/cfssl.conf.orig
  +++ /etc/cfssl/signers/mlserve_staging/cfssl.conf
  @@ -1,81 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "signing",
  -        "key encipherment",
  -        "client auth"
  -      ],
  -      "expiry": "72h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/mlserve_staging",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/mlserve_staging"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "72h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "service-account-management": {
  -        "auth_key": "default_auth",
  -        "expiry": "72h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment"
  -        ]
  -      },
  -      "prometheus": {
  -        "auth_key": "default_auth",
  -        "expiry": "8760h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "client auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_wikikube.service
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Service[cfssl-ocspserve@debmonitor]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@debmonitor].orig
  +++ Systemd::Service[cfssl-ocspserve@debmonitor]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Service[apache2]

  Parameters differences:

  --- Service[apache2].orig
  +++ Service[apache2]
  
  -    require    => Package[apache2]
  -    ensure     => running
  -    before     => ['Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]']
  -    enable     => True
  -    restart    => systemctl reload apache2
  -    hasrestart => True
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_aux command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_aux
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "f7dfe9e2cd77303dfae7ae11c5c56d90" --timeout 10 --check-command "check_check_certificate_expiry_aux"

• File[/etc/logrotate.d/ulogd]

  Parameters differences:

  --- File[/etc/logrotate.d/ulogd].orig
  +++ File[/etc/logrotate.d/ulogd]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/ulogd.orig
  +++ /etc/logrotate.d/ulogd
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for ulogd
  -
  -/var/log/ulogd/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Monitoring::Exported_nagios_host[pki1001]

  Parameters differences:

  --- Monitoring::Exported_nagios_host[pki1001].orig
  +++ Monitoring::Exported_nagios_host[pki1001]
  
  @@
  -    notifications_enabled => 1
  +    notifications_enabled => 0
  @@
  -    hostgroups            => pki_eqiad,asw2-a-eqiad
  +    hostgroups            => insetup_eqiad,asw2-a-eqiad
  

• Prometheus::Blackbox::Check::Http[PKI_dse_front_proxy]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_dse_front_proxy].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_dse_front_proxy]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"dse_front_proxy"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_f389c556cebfcfc345b3d6802f320045]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_f389c556cebfcfc345b3d6802f320045].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_f389c556cebfcfc345b3d6802f320045]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_staging
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="f389c556cebfcfc345b3d6802f320045",check_name="check_check_certificate_expiry_wikikube_staging", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__wikikube_staging
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_staging
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_wikikube_staging))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]']
  -    refreshonly => True
  

• File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - puppet_rsa
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --responses-file /etc/cfssl/ocsp/puppet_rsa.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@puppet_rsa' puppet_rsa 

• Cfssl::Cert[OCSP_kafka_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_kafka_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_kafka_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => kafka
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@kafka]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-kafka]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Service[cfssl-ocsprefresh-dse_front_proxy]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-dse_front_proxy].orig
  +++ Systemd::Service[cfssl-ocsprefresh-dse_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Monitoring::Service[check_certificate_expiry_mlserve_staging]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_mlserve_staging].orig
  +++ Monitoring::Service[check_certificate_expiry_mlserve_staging]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: mlserve_staging
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_mlserve_staging!10
  

• Systemd::Service[cfssl-gc-expired-certs]

  Parameters differences:

  --- Systemd::Service[cfssl-gc-expired-certs].orig
  +++ Systemd::Service[cfssl-gc-expired-certs]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-gc-expired-certs.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - aux_front_proxy
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --responses-file /etc/cfssl/ocsp/aux_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@aux_front_proxy' aux_front_proxy 

• Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@discovery2026]']
  -    refreshonly => True
  

• File[/lib/systemd/system/cfssl-ocsprefresh-aux.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-aux.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-aux.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-aux.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-aux.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - aux
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/aux/ca/aux.pem --responses-file /etc/cfssl/ocsp/aux.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@aux' aux 

• Monitoring::Service[check_certificate_expiry_wikikube_front_proxy]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_wikikube_front_proxy].orig
  +++ Monitoring::Service[check_certificate_expiry_wikikube_front_proxy]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: wikikube_front_proxy
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_wikikube_front_proxy!10
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_debmonitor" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse -profile ocsp /etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging_front_proxy]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging_front_proxy]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@mlserve_staging.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@mlserve_staging.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (mlserve_staging)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 20040 \
  -          -responses /etc/cfssl/ocsp/mlserve_staging.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/cfssl/ocsp/debmonitor.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/debmonitor.ocsp].orig
  +++ File[/etc/cfssl/ocsp/debmonitor.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Sudo::User[nrpe_certificate_check_mlserve_front_proxy]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_mlserve_front_proxy].orig
  +++ Sudo::User[nrpe_certificate_check_mlserve_front_proxy]
  
  -    user       => nrpe_certificate_check_mlserve_front_proxy
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• File[/var/log/cfssl-ocsprefresh-mlserve]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-mlserve].orig
  +++ File[/var/log/cfssl-ocsprefresh-mlserve]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_cassandra.service
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-aux.timer]']
  -    refreshonly => True
  

• File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft].orig
  +++ File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft.orig
  +++ /etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft
  @@ -0,0 +1,15 @@
  +# Autogenerated by puppet
  +set KAFKA_BROKERS_LOGGING_ipv4 {
  +    type ipv4_addr
  +    elements = { 10.64.16.205,
  +             10.64.133.11,
  +             10.64.183.12,
  +             10.64.131.13,
  +             10.64.135.13,
  +             10.192.23.29,
  +             10.192.11.28,
  +             10.192.26.22,
  +             10.192.11.27,
  +             10.192.39.25
  +    }
  +}

• Systemd::Service[prometheus-node-textfile-check-nft]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-check-nft].orig
  +++ Systemd::Service[prometheus-node-textfile-check-nft]
  
  +    migration_task           => T407130
  +    unit_type                => timer
  +    ensure                   => present
  +    monitoring_critical      => False
  +    restart                  => False
  +    require                  => Systemd::Unit[prometheus-node-textfile-check-nft.service]
  +    service_params           => {}
  +    override                 => False
  +    monitoring_enabled       => False
  +    monitoring_contact_group => admins
  

• File[/etc/ferm/conf.d/00_defs]

  Parameters differences:

  --- File[/etc/ferm/conf.d/00_defs].orig
  +++ File[/etc/ferm/conf.d/00_defs]
  
  -    notify  => Service[ferm]
  -    require => File[/etc/ferm/conf.d]
  -    ensure  => present
  -    owner   => root
  -    tag     => ferm
  -    mode    => 0400
  -    group   => root
  

  Content differences:

  --- /etc/ferm/conf.d/00_defs.orig
  +++ /etc/ferm/conf.d/00_defs
  @@ -1,1139 +0,0 @@
  -
  -@def $LINK_LOCAL = (169.254.0.0/16 fe80::/10);
  -@def $INTERNAL = (10.0.0.0/8 2620:0:860:100::/56 2620:0:861:100::/56 2620:0:863:100::/56 2001:df2:e500:100::/56 2a02:ec80:300:100::/56 2a02:ec80:600:100::/56 2a02:ec80:700:100::/56 2a02:ec80:ff00:100::/56);
  -# $DOMAIN_NETWORKS is a set of all networks belonging to a domain.
  -# a domain is a realm currently, but the notion is more generic than that on purpose
  -@def $DOMAIN_NETWORKS = (10.128.0.0/24 10.128.1.0/24 10.128.2.0/24 10.132.0.0/24 10.132.2.0/24 10.136.0.0/24 10.136.1.0/24 10.140.0.0/24 10.140.1.0/24 10.140.2.0/24 10.192.0.0/22 10.192.10.0/24 10.192.11.0/24 10.192.12.0/24 10.192.13.0/24 10.192.14.0/24 10.192.15.0/24 10.192.16.0/22 10.192.20.0/24 10.192.21.0/24 10.192.22.0/24 10.192.23.0/24 10.192.24.0/23 10.192.26.0/24 10.192.27.0/24 10.192.28.0/24 10.192.29.0/24 10.192.30.0/24 10.192.31.0/24 10.192.32.0/22 10.192.36.0/24 10.192.37.0/24 10.192.38.0/24 10.192.39.0/24 10.192.4.0/24 10.192.40.0/24 10.192.41.0/24 10.192.42.0/24 10.192.43.0/24 10.192.44.0/24 10.192.45.0/24 10.192.46.0/24 10.192.47.0/24 10.192.48.0/22 10.192.5.0/24 10.192.52.0/24 10.192.56.0/24 10.192.57.0/24 10.192.58.0/24 10.192.59.0/24 10.192.6.0/24 10.192.64.0/21 10.192.7.0/24 10.192.72.0/24 10.192.76.0/24 10.192.8.0/24 10.192.80.0/20 10.192.9.0/24 10.192.96.0/21 10.194.0.0/20 10.194.128.0/17 10.194.16.0/21 10.194.61.0/24 10.194.62.0/23 10.194.64.0/20 10.194.80.0/21 10.2.1.0/24 10.2.2.0/24 10.2.3.0/24 10.2.4.0/24 10.2.5.0/24 10.2.6.0/24 10.2.7.0/24 10.64.0.0/22 10.64.130.0/24 10.64.131.0/24 10.64.132.0/24 10.64.133.0/24 10.64.134.0/24 10.64.135.0/24 10.64.136.0/24 10.64.137.0/24 10.64.138.0/24 10.64.139.0/24 10.64.140.0/24 10.64.141.0/24 10.64.142.0/24 10.64.143.0/24 10.64.144.0/24 10.64.145.0/24 10.64.148.0/24 10.64.149.0/24 10.64.150.0/24 10.64.151.0/24 10.64.152.0/24 10.64.153.0/24 10.64.154.0/24 10.64.155.0/24 10.64.156.0/24 10.64.157.0/24 10.64.158.0/24 10.64.159.0/24 10.64.16.0/22 10.64.160.0/24 10.64.161.0/24 10.64.162.0/24 10.64.163.0/24 10.64.164.0/24 10.64.165.0/24 10.64.166.0/24 10.64.167.0/24 10.64.169.0/24 10.64.170.0/24 10.64.171.0/24 10.64.172.0/24 10.64.173.0/24 10.64.174.0/24 10.64.175.0/24 10.64.176.0/24 10.64.177.0/24 10.64.178.0/24 10.64.179.0/24 10.64.180.0/24 10.64.181.0/24 10.64.182.0/24 10.64.183.0/24 10.64.184.0/24 10.64.185.0/24 10.64.186.0/24 10.64.187.0/24 10.64.188.0/24 10.64.189.0/24 10.64.190.0/24 10.64.20.0/24 10.64.21.0/24 10.64.24.0/23 10.64.32.0/22 10.64.36.0/24 10.64.48.0/22 10.64.5.0/24 10.64.53.0/24 10.64.64.0/21 10.64.72.0/24 10.64.76.0/24 10.67.0.0/20 10.67.128.0/17 10.67.16.0/21 10.67.24.0/21 10.67.32.0/20 10.67.64.0/20 10.67.80.0/21 10.80.0.0/24 10.80.1.0/24 10.80.2.0/24 103.102.166.0/28 103.102.166.224/27 103.102.166.96/27 185.15.58.0/27 185.15.58.224/27 185.15.58.32/27 185.15.59.0/27 185.15.59.224/27 185.15.59.32/27 185.15.59.96/27 195.200.68.0/27 195.200.68.224/27 195.200.68.32/27 195.200.68.96/27 198.35.26.0/27 198.35.26.32/27 198.35.26.96/27 198.35.26.96/27 2001:df2:e500:101::/64 2001:df2:e500:103::/64 2001:df2:e500:1::/64 2001:df2:e500:3::/64 2001:df2:e500:ed1a::/64 208.80.152.128/27 208.80.153.0/27 208.80.153.224/27 208.80.153.32/27 208.80.153.64/27 208.80.153.96/27 208.80.154.0/26 208.80.154.128/26 208.80.154.224/27 208.80.154.64/26 208.80.155.96/27 2620:0:860:100::/64 2620:0:860:101::/64 2620:0:860:102::/64 2620:0:860:103::/64 2620:0:860:104::/64 2620:0:860:105::/64 2620:0:860:106::/64 2620:0:860:107::/64 2620:0:860:108::/64 2620:0:860:109::/64 2620:0:860:10a::/64 2620:0:860:10b::/64 2620:0:860:10c::/64 2620:0:860:10d::/64 2620:0:860:10e::/64 2620:0:860:10f::/64 2620:0:860:110::/64 2620:0:860:111::/64 2620:0:860:112::/64 2620:0:860:113::/64 2620:0:860:114::/64 2620:0:860:115::/64 2620:0:860:116::/64 2620:0:860:118::/64 2620:0:860:119::/64 2620:0:860:11a::/64 2620:0:860:11b::/64 2620:0:860:11c::/64 2620:0:860:11d::/64 2620:0:860:11e::/64 2620:0:860:11f::/64 2620:0:860:120::/64 2620:0:860:121::/64 2620:0:860:122::/64 2620:0:860:123::/64 2620:0:860:124::/64 2620:0:860:125::/64 2620:0:860:126::/64 2620:0:860:127::/64 2620:0:860:12b::/64 2620:0:860:12c::/64 2620:0:860:12d::/64 2620:0:860:12e::/64 2620:0:860:140::/64 2620:0:860:1::/64 2620:0:860:2::/64 2620:0:860:300::/64 2620:0:860:301::/64 2620:0:860:302::/64 2620:0:860:303::/64 2620:0:860:304::/64 2620:0:860:305::/64 2620:0:860:307::/64 2620:0:860:308::/64 2620:0:860:3::/64 2620:0:860:4::/64 2620:0:860:5::/64 2620:0:860:babe::/64 2620:0:860:babf::/64 2620:0:860:cabe::/64 2620:0:860:cabf::/64 2620:0:860:ed1a::/64 2620:0:861:100::/64 2620:0:861:101::/64 2620:0:861:102::/64 2620:0:861:103::/64 2620:0:861:104::/64 2620:0:861:105::/64 2620:0:861:106::/64 2620:0:861:107::/64 2620:0:861:108::/64 2620:0:861:109::/64 2620:0:861:10a::/64 2620:0:861:10b::/64 2620:0:861:10c::/64 2620:0:861:10d::/64 2620:0:861:10e::/64 2620:0:861:10f::/64 2620:0:861:110::/64 2620:0:861:111::/64 2620:0:861:112::/64 2620:0:861:113::/64 2620:0:861:114::/64 2620:0:861:115::/64 2620:0:861:116::/64 2620:0:861:117::/64 2620:0:861:118::/64 2620:0:861:119::/64 2620:0:861:11a::/64 2620:0:861:11c::/64 2620:0:861:11d::/64 2620:0:861:11e::/64 2620:0:861:11f::/64 2620:0:861:120::/64 2620:0:861:121::/64 2620:0:861:122::/64 2620:0:861:123::/64 2620:0:861:124::/64 2620:0:861:125::/64 2620:0:861:126::/64 2620:0:861:127::/64 2620:0:861:128::/64 2620:0:861:129::/64 2620:0:861:12a::/64 2620:0:861:12b::/64 2620:0:861:12c::/64 2620:0:861:12d::/64 2620:0:861:12e::/64 2620:0:861:12f::/64 2620:0:861:131::/64 2620:0:861:132::/64 2620:0:861:133::/64 2620:0:861:134::/64 2620:0:861:135::/64 2620:0:861:136::/64 2620:0:861:137::/64 2620:0:861:138::/64 2620:0:861:139::/64 2620:0:861:13a::/64 2620:0:861:13b::/64 2620:0:861:13c::/64 2620:0:861:13d::/64 2620:0:861:13e::/64 2620:0:861:13f::/64 2620:0:861:140::/64 2620:0:861:141::/64 2620:0:861:142::/64 2620:0:861:143::/64 2620:0:861:144::/64 2620:0:861:145::/64 2620:0:861:1::/64 2620:0:861:2::/64 2620:0:861:300::/64 2620:0:861:301::/116 2620:0:861:302::/64 2620:0:861:303::/116 2620:0:861:304::/116 2620:0:861:305::/64 2620:0:861:3::/64 2620:0:861:4::/64 2620:0:861:babe::/64 2620:0:861:babf::/116 2620:0:861:cabe::/64 2620:0:861:cabf::/116 2620:0:861:ed1a::/64 2620:0:863:101::/64 2620:0:863:102::/64 2620:0:863:103::/64 2620:0:863:1::/64 2620:0:863:2::/64 2620:0:863:3::/64 2620:0:863:ed1a::/64 2a02:ec80:300:101::/64 2a02:ec80:300:102::/64 2a02:ec80:300:103::/64 2a02:ec80:300:1::/64 2a02:ec80:300:2::/64 2a02:ec80:300:3::/64 2a02:ec80:300:ed1a::/64 2a02:ec80:600:101::/64 2a02:ec80:600:102::/64 2a02:ec80:600:1::/64 2a02:ec80:600:2::/64 2a02:ec80:600:ed1a::/64 2a02:ec80:700:101::/64 2a02:ec80:700:102::/64 2a02:ec80:700:103::/64 2a02:ec80:700:1::/64 2a02:ec80:700:2::/64 2a02:ec80:700:3::/64 2a02:ec80:700:ed1a::/64 );
  -
  -# $PRODUCTION_NETWORKS is a set of all production networks
  -@def $PRODUCTION_NETWORKS = (10.128.0.0/24 10.128.1.0/24 10.128.2.0/24 10.132.0.0/24 10.132.2.0/24 10.136.0.0/24 10.136.1.0/24 10.140.0.0/24 10.140.1.0/24 10.140.2.0/24 10.192.0.0/22 10.192.10.0/24 10.192.11.0/24 10.192.12.0/24 10.192.13.0/24 10.192.14.0/24 10.192.15.0/24 10.192.16.0/22 10.192.20.0/24 10.192.21.0/24 10.192.22.0/24 10.192.23.0/24 10.192.24.0/23 10.192.26.0/24 10.192.27.0/24 10.192.28.0/24 10.192.29.0/24 10.192.30.0/24 10.192.31.0/24 10.192.32.0/22 10.192.36.0/24 10.192.37.0/24 10.192.38.0/24 10.192.39.0/24 10.192.4.0/24 10.192.40.0/24 10.192.41.0/24 10.192.42.0/24 10.192.43.0/24 10.192.44.0/24 10.192.45.0/24 10.192.46.0/24 10.192.47.0/24 10.192.48.0/22 10.192.5.0/24 10.192.52.0/24 10.192.56.0/24 10.192.57.0/24 10.192.58.0/24 10.192.59.0/24 10.192.6.0/24 10.192.64.0/21 10.192.7.0/24 10.192.72.0/24 10.192.76.0/24 10.192.8.0/24 10.192.80.0/20 10.192.9.0/24 10.192.96.0/21 10.194.0.0/20 10.194.128.0/17 10.194.16.0/21 10.194.61.0/24 10.194.62.0/23 10.194.64.0/20 10.194.80.0/21 10.2.1.0/24 10.2.2.0/24 10.2.3.0/24 10.2.4.0/24 10.2.5.0/24 10.2.6.0/24 10.2.7.0/24 10.64.0.0/22 10.64.130.0/24 10.64.131.0/24 10.64.132.0/24 10.64.133.0/24 10.64.134.0/24 10.64.135.0/24 10.64.136.0/24 10.64.137.0/24 10.64.138.0/24 10.64.139.0/24 10.64.140.0/24 10.64.141.0/24 10.64.142.0/24 10.64.143.0/24 10.64.144.0/24 10.64.145.0/24 10.64.148.0/24 10.64.149.0/24 10.64.150.0/24 10.64.151.0/24 10.64.152.0/24 10.64.153.0/24 10.64.154.0/24 10.64.155.0/24 10.64.156.0/24 10.64.157.0/24 10.64.158.0/24 10.64.159.0/24 10.64.16.0/22 10.64.160.0/24 10.64.161.0/24 10.64.162.0/24 10.64.163.0/24 10.64.164.0/24 10.64.165.0/24 10.64.166.0/24 10.64.167.0/24 10.64.169.0/24 10.64.170.0/24 10.64.171.0/24 10.64.172.0/24 10.64.173.0/24 10.64.174.0/24 10.64.175.0/24 10.64.176.0/24 10.64.177.0/24 10.64.178.0/24 10.64.179.0/24 10.64.180.0/24 10.64.181.0/24 10.64.182.0/24 10.64.183.0/24 10.64.184.0/24 10.64.185.0/24 10.64.186.0/24 10.64.187.0/24 10.64.188.0/24 10.64.189.0/24 10.64.190.0/24 10.64.20.0/24 10.64.21.0/24 10.64.24.0/23 10.64.32.0/22 10.64.36.0/24 10.64.48.0/22 10.64.5.0/24 10.64.53.0/24 10.64.64.0/21 10.64.72.0/24 10.64.76.0/24 10.67.0.0/20 10.67.128.0/17 10.67.16.0/21 10.67.24.0/21 10.67.32.0/20 10.67.64.0/20 10.67.80.0/21 10.80.0.0/24 10.80.1.0/24 10.80.2.0/24 103.102.166.0/28 103.102.166.224/27 103.102.166.96/27 185.15.58.0/27 185.15.58.224/27 185.15.58.32/27 185.15.59.0/27 185.15.59.224/27 185.15.59.32/27 185.15.59.96/27 195.200.68.0/27 195.200.68.224/27 195.200.68.32/27 195.200.68.96/27 198.35.26.0/27 198.35.26.32/27 198.35.26.96/27 198.35.26.96/27 2001:df2:e500:101::/64 2001:df2:e500:103::/64 2001:df2:e500:1::/64 2001:df2:e500:3::/64 2001:df2:e500:ed1a::/64 208.80.152.128/27 208.80.153.0/27 208.80.153.224/27 208.80.153.32/27 208.80.153.64/27 208.80.153.96/27 208.80.154.0/26 208.80.154.128/26 208.80.154.224/27 208.80.154.64/26 208.80.155.96/27 2620:0:860:100::/64 2620:0:860:101::/64 2620:0:860:102::/64 2620:0:860:103::/64 2620:0:860:104::/64 2620:0:860:105::/64 2620:0:860:106::/64 2620:0:860:107::/64 2620:0:860:108::/64 2620:0:860:109::/64 2620:0:860:10a::/64 2620:0:860:10b::/64 2620:0:860:10c::/64 2620:0:860:10d::/64 2620:0:860:10e::/64 2620:0:860:10f::/64 2620:0:860:110::/64 2620:0:860:111::/64 2620:0:860:112::/64 2620:0:860:113::/64 2620:0:860:114::/64 2620:0:860:115::/64 2620:0:860:116::/64 2620:0:860:118::/64 2620:0:860:119::/64 2620:0:860:11a::/64 2620:0:860:11b::/64 2620:0:860:11c::/64 2620:0:860:11d::/64 2620:0:860:11e::/64 2620:0:860:11f::/64 2620:0:860:120::/64 2620:0:860:121::/64 2620:0:860:122::/64 2620:0:860:123::/64 2620:0:860:124::/64 2620:0:860:125::/64 2620:0:860:126::/64 2620:0:860:127::/64 2620:0:860:12b::/64 2620:0:860:12c::/64 2620:0:860:12d::/64 2620:0:860:12e::/64 2620:0:860:140::/64 2620:0:860:1::/64 2620:0:860:2::/64 2620:0:860:300::/64 2620:0:860:301::/64 2620:0:860:302::/64 2620:0:860:303::/64 2620:0:860:304::/64 2620:0:860:305::/64 2620:0:860:307::/64 2620:0:860:308::/64 2620:0:860:3::/64 2620:0:860:4::/64 2620:0:860:5::/64 2620:0:860:babe::/64 2620:0:860:babf::/64 2620:0:860:cabe::/64 2620:0:860:cabf::/64 2620:0:860:ed1a::/64 2620:0:861:100::/64 2620:0:861:101::/64 2620:0:861:102::/64 2620:0:861:103::/64 2620:0:861:104::/64 2620:0:861:105::/64 2620:0:861:106::/64 2620:0:861:107::/64 2620:0:861:108::/64 2620:0:861:109::/64 2620:0:861:10a::/64 2620:0:861:10b::/64 2620:0:861:10c::/64 2620:0:861:10d::/64 2620:0:861:10e::/64 2620:0:861:10f::/64 2620:0:861:110::/64 2620:0:861:111::/64 2620:0:861:112::/64 2620:0:861:113::/64 2620:0:861:114::/64 2620:0:861:115::/64 2620:0:861:116::/64 2620:0:861:117::/64 2620:0:861:118::/64 2620:0:861:119::/64 2620:0:861:11a::/64 2620:0:861:11c::/64 2620:0:861:11d::/64 2620:0:861:11e::/64 2620:0:861:11f::/64 2620:0:861:120::/64 2620:0:861:121::/64 2620:0:861:122::/64 2620:0:861:123::/64 2620:0:861:124::/64 2620:0:861:125::/64 2620:0:861:126::/64 2620:0:861:127::/64 2620:0:861:128::/64 2620:0:861:129::/64 2620:0:861:12a::/64 2620:0:861:12b::/64 2620:0:861:12c::/64 2620:0:861:12d::/64 2620:0:861:12e::/64 2620:0:861:12f::/64 2620:0:861:131::/64 2620:0:861:132::/64 2620:0:861:133::/64 2620:0:861:134::/64 2620:0:861:135::/64 2620:0:861:136::/64 2620:0:861:137::/64 2620:0:861:138::/64 2620:0:861:139::/64 2620:0:861:13a::/64 2620:0:861:13b::/64 2620:0:861:13c::/64 2620:0:861:13d::/64 2620:0:861:13e::/64 2620:0:861:13f::/64 2620:0:861:140::/64 2620:0:861:141::/64 2620:0:861:142::/64 2620:0:861:143::/64 2620:0:861:144::/64 2620:0:861:145::/64 2620:0:861:1::/64 2620:0:861:2::/64 2620:0:861:300::/64 2620:0:861:301::/116 2620:0:861:302::/64 2620:0:861:303::/116 2620:0:861:304::/116 2620:0:861:305::/64 2620:0:861:3::/64 2620:0:861:4::/64 2620:0:861:babe::/64 2620:0:861:babf::/116 2620:0:861:cabe::/64 2620:0:861:cabf::/116 2620:0:861:ed1a::/64 2620:0:863:101::/64 2620:0:863:102::/64 2620:0:863:103::/64 2620:0:863:1::/64 2620:0:863:2::/64 2620:0:863:3::/64 2620:0:863:ed1a::/64 2a02:ec80:300:101::/64 2a02:ec80:300:102::/64 2a02:ec80:300:103::/64 2a02:ec80:300:1::/64 2a02:ec80:300:2::/64 2a02:ec80:300:3::/64 2a02:ec80:300:ed1a::/64 2a02:ec80:600:101::/64 2a02:ec80:600:102::/64 2a02:ec80:600:1::/64 2a02:ec80:600:2::/64 2a02:ec80:600:ed1a::/64 2a02:ec80:700:101::/64 2a02:ec80:700:102::/64 2a02:ec80:700:103::/64 2a02:ec80:700:1::/64 2a02:ec80:700:2::/64 2a02:ec80:700:3::/64 2a02:ec80:700:ed1a::/64 );
  -# $CLOUD_NETWORKS is a set of all Cloud VPS instance networks
  -@def $CLOUD_NETWORKS = (172.16.0.0/21 172.16.128.0/24 172.16.129.0/24 172.16.130.0/24 172.16.131.0/24 172.16.16.0/21 172.16.24.0/24 172.16.8.0/21 172.20.1.0/24 172.20.2.0/24 172.20.254.0/24 172.20.255.0/24 172.20.3.0/24 172.20.4.0/24 172.20.5.0/24 185.15.56.0/25 185.15.56.160/28 185.15.57.0/29 185.15.57.16/29 185.15.57.24/29 2a02:ec80:a000:100::/64 2a02:ec80:a000:1::/64 2a02:ec80:a000:201::/64 2a02:ec80:a000:202::/64 2a02:ec80:a000:203::/64 2a02:ec80:a000:204::/64 2a02:ec80:a000:2ff::/64 2a02:ec80:a000:4000::/64 2a02:ec80:a100:100::/64 2a02:ec80:a100:1::/64 2a02:ec80:a100:205::/64 2a02:ec80:a100:2ff::/64 2a02:ec80:a100:4000::/64 );
  -# $LABS_NETWORKS is a deprecated alias for $CLOUD_NETWORKS
  -@def $LABS_NETWORKS = (172.16.0.0/21 172.16.128.0/24 172.16.129.0/24 172.16.130.0/24 172.16.131.0/24 172.16.16.0/21 172.16.24.0/24 172.16.8.0/21 172.20.1.0/24 172.20.2.0/24 172.20.254.0/24 172.20.255.0/24 172.20.3.0/24 172.20.4.0/24 172.20.5.0/24 185.15.56.0/25 185.15.56.160/28 185.15.57.0/29 185.15.57.16/29 185.15.57.24/29 2a02:ec80:a000:100::/64 2a02:ec80:a000:1::/64 2a02:ec80:a000:201::/64 2a02:ec80:a000:202::/64 2a02:ec80:a000:203::/64 2a02:ec80:a000:204::/64 2a02:ec80:a000:2ff::/64 2a02:ec80:a000:4000::/64 2a02:ec80:a100:100::/64 2a02:ec80:a100:1::/64 2a02:ec80:a100:205::/64 2a02:ec80:a100:2ff::/64 2a02:ec80:a100:4000::/64 );
  -# $CLOUD_NETWORKS_PUBLIC is meant to be a set of all Cloud public networks
  -@def $CLOUD_NETWORKS_PUBLIC = (185.15.56.0/25 185.15.56.160/28 185.15.57.0/29 185.15.57.16/29 185.15.57.24/29 2a02:ec80:a000:4000::/64 2a02:ec80:a100:4000::/64 );
  -# $CLOUD_PRIVATE_NETWORKS is the cloud-private networks with WMCS
  -# hardware with cloud realm private 172.20.x.x addresses. These
  -# hosts are dual-homed, usually also in at least cloud-hosts.
  -@def $CLOUD_PRIVATE_NETWORKS = (172.20.1.0/24 172.20.2.0/24 172.20.3.0/24 172.20.4.0/24 2a02:ec80:a000:201::/64 2a02:ec80:a000:202::/64 2a02:ec80:a000:203::/64 2a02:ec80:a000:204::/64 172.20.5.0/24 2a02:ec80:a100:205::/64);
  -# $FRACK_NETWORKS is meant to be a set of all fundraising networks
  -@def $FRACK_NETWORKS = (10.195.0.0/27 10.195.0.128/29 10.195.0.32/27 10.195.0.64/28 10.195.0.80/29 10.195.0.96/27 10.195.1.0/25 10.64.40.0/27 10.64.40.160/27 10.64.40.192/26 10.64.40.32/27 10.64.40.64/27 10.64.40.96/27 208.80.152.224/28 208.80.155.0/27 );
  -
  -@def $ANALYTICS_NETWORKS = (10.64.137.0/24 10.64.138.0/24 10.64.139.0/24 10.64.140.0/24 10.64.142.0/24 10.64.143.0/24 10.64.144.0/24 10.64.145.0/24 10.64.153.0/24 10.64.155.0/24 10.64.157.0/24 10.64.159.0/24 10.64.161.0/24 10.64.163.0/24 10.64.165.0/24 10.64.167.0/24 10.64.170.0/24 10.64.172.0/24 10.64.174.0/24 10.64.176.0/24 10.64.178.0/24 10.64.180.0/24 10.64.182.0/24 10.64.184.0/24 10.64.186.0/24 10.64.188.0/24 10.64.190.0/24 10.64.21.0/24 10.64.36.0/24 10.64.5.0/24 10.64.53.0/24 2620:0:861:100::/64 2620:0:861:104::/64 2620:0:861:105::/64 2620:0:861:106::/64 2620:0:861:108::/64 2620:0:861:110::/64 2620:0:861:111::/64 2620:0:861:112::/64 2620:0:861:114::/64 2620:0:861:115::/64 2620:0:861:116::/64 2620:0:861:117::/64 2620:0:861:11a::/64 2620:0:861:121::/64 2620:0:861:123::/64 2620:0:861:125::/64 2620:0:861:127::/64 2620:0:861:129::/64 2620:0:861:12b::/64 2620:0:861:12d::/64 2620:0:861:12f::/64 2620:0:861:132::/64 2620:0:861:134::/64 2620:0:861:136::/64 2620:0:861:138::/64 2620:0:861:13a::/64 2620:0:861:13c::/64 2620:0:861:13e::/64 2620:0:861:141::/64 2620:0:861:143::/64 2620:0:861:145::/64 );
  -@def $MW_APPSERVER_NETWORKS = (10.64.0.0/22 10.64.130.0/24 10.64.131.0/24 10.64.132.0/24 10.64.133.0/24 10.64.134.0/24 10.64.135.0/24 10.64.136.0/24 10.64.141.0/24 10.64.152.0/24 10.64.154.0/24 10.64.156.0/24 10.64.158.0/24 10.64.16.0/22 10.64.160.0/24 10.64.162.0/24 10.64.164.0/24 10.64.166.0/24 10.64.169.0/24 10.64.171.0/24 10.64.173.0/24 10.64.175.0/24 10.64.177.0/24 10.64.179.0/24 10.64.181.0/24 10.64.183.0/24 10.64.185.0/24 10.64.187.0/24 10.64.189.0/24 10.64.32.0/22 10.64.48.0/22 2620:0:861:101::/64 2620:0:861:102::/64 2620:0:861:103::/64 2620:0:861:107::/64 2620:0:861:109::/64 2620:0:861:10a::/64 2620:0:861:10b::/64 2620:0:861:10c::/64 2620:0:861:10d::/64 2620:0:861:10e::/64 2620:0:861:10f::/64 2620:0:861:113::/64 2620:0:861:119::/64 2620:0:861:120::/64 2620:0:861:122::/64 2620:0:861:124::/64 2620:0:861:126::/64 2620:0:861:128::/64 2620:0:861:12a::/64 2620:0:861:12c::/64 2620:0:861:12e::/64 2620:0:861:131::/64 2620:0:861:133::/64 2620:0:861:135::/64 2620:0:861:137::/64 2620:0:861:139::/64 2620:0:861:13b::/64 2620:0:861:13d::/64 2620:0:861:13f::/64 2620:0:861:142::/64 2620:0:861:144::/64 10.192.0.0/22 10.192.10.0/24 10.192.11.0/24 10.192.12.0/24 10.192.13.0/24 10.192.14.0/24 10.192.15.0/24 10.192.16.0/22 10.192.21.0/24 10.192.22.0/24 10.192.23.0/24 10.192.26.0/24 10.192.27.0/24 10.192.28.0/24 10.192.29.0/24 10.192.30.0/24 10.192.31.0/24 10.192.32.0/22 10.192.36.0/24 10.192.37.0/24 10.192.38.0/24 10.192.39.0/24 10.192.4.0/24 10.192.40.0/24 10.192.41.0/24 10.192.42.0/24 10.192.43.0/24 10.192.44.0/24 10.192.45.0/24 10.192.46.0/24 10.192.47.0/24 10.192.48.0/22 10.192.5.0/24 10.192.52.0/24 10.192.56.0/24 10.192.57.0/24 10.192.58.0/24 10.192.59.0/24 10.192.6.0/24 10.192.7.0/24 10.192.8.0/24 10.192.9.0/24 2620:0:860:100::/64 2620:0:860:101::/64 2620:0:860:102::/64 2620:0:860:103::/64 2620:0:860:104::/64 2620:0:860:105::/64 2620:0:860:106::/64 2620:0:860:107::/64 2620:0:860:108::/64 2620:0:860:109::/64 2620:0:860:10a::/64 2620:0:860:10b::/64 2620:0:860:10c::/64 2620:0:860:10d::/64 2620:0:860:10e::/64 2620:0:860:10f::/64 2620:0:860:110::/64 2620:0:860:111::/64 2620:0:860:112::/64 2620:0:860:113::/64 2620:0:860:114::/64 2620:0:860:115::/64 2620:0:860:116::/64 2620:0:860:119::/64 2620:0:860:11a::/64 2620:0:860:11b::/64 2620:0:860:11c::/64 2620:0:860:11d::/64 2620:0:860:11e::/64 2620:0:860:11f::/64 2620:0:860:120::/64 2620:0:860:121::/64 2620:0:860:122::/64 2620:0:860:123::/64 2620:0:860:124::/64 2620:0:860:125::/64 2620:0:860:126::/64 2620:0:860:127::/64 2620:0:860:12b::/64 2620:0:860:12c::/64 2620:0:860:12d::/64 2620:0:860:12e::/64 10.192.64.0/21 10.192.96.0/21 10.194.128.0/17 10.194.16.0/21 10.194.61.0/24 10.194.80.0/21 10.64.64.0/21 10.67.128.0/17 10.67.16.0/21 10.67.24.0/21 10.67.80.0/21 2620:0:860:300::/64 2620:0:860:302::/64 2620:0:860:305::/64 2620:0:860:308::/64 2620:0:860:babe::/64 2620:0:860:cabe::/64 2620:0:861:300::/64 2620:0:861:302::/64 2620:0:861:305::/64 2620:0:861:babe::/64 2620:0:861:cabe::/64 208.80.154.0/26 208.80.154.128/26 208.80.154.64/26 208.80.155.96/27 2620:0:861:1::/64 2620:0:861:2::/64 2620:0:861:3::/64 2620:0:861:4::/64 208.80.153.0/27 208.80.153.32/27 208.80.153.64/27 208.80.153.96/27 2620:0:860:1::/64 2620:0:860:2::/64 2620:0:860:3::/64 2620:0:860:4::/64 );
  -@def $WIKIKUBE_KUBEPODS_NETWORKS  = (10.67.128.0/17 2620:0:861:cabe::/64 10.194.128.0/17 2620:0:860:cabe::/64 );
  -@def $STAGING_KUBEPODS_NETWORKS  = (10.64.64.0/21 2620:0:861:babe::/64 10.192.64.0/21 2620:0:860:babe::/64 );
  -@def $MLSERVE_KUBEPODS_NETWORKS = (10.67.16.0/21 2620:0:861:300::/64 10.194.16.0/21 2620:0:860:300::/64 );
  -@def $MLSTAGE_KUBEPODS_NETWORKS = (10.194.61.0/24 2620:0:860:302::/64 );
  -@def $DSE_KUBEPODS_NETWORKS = (10.67.24.0/21 2620:0:861:302::/64 10.192.96.0/21 2620:0:860:308::/64 );
  -@def $AUX_KUBEPODS_NETWORKS = (10.67.80.0/21 2620:0:861:305::/64 10.194.80.0/21 2620:0:860:305::/64 );
  -
  -@def $NETWORK_INFRA = (185.15.59.128/27 2a02:ec80:300:fe00::/55 198.35.26.128/27 2620:0:863:fe00::/55 208.80.153.192/27 2620:0:860:fe00::/55 10.192.255.0/24 2620:0:860:13f::/64 10.192.253.0/24 2620:0:860:139::/64 208.80.154.192/27 2620:0:861:fe00::/55 10.64.146.0/24 2620:0:861:11b::/128 10.64.168.0/24 2620:0:861:130::/64 10.64.147.0/24 103.102.166.128/27 2001:df2:e500:fe00::/55 185.15.58.128/27 2a02:ec80:600:fe00::/55 195.200.68.128/27 2a02:ec80:700:fe00::/55);
  -@def $MGMT_NETWORKS = (10.65.0.0/16 10.128.128.0/17 10.193.0.0/16 10.80.128.0/17 10.132.128.0/17 10.136.128.0/17 10.140.128.0/17 );
  -@def $SANDBOX_NETWORKS = (103.102.166.72/29 185.15.59.72/29 195.200.68.64/29 198.35.26.240/28 2001:df2:e500:202::/64 208.80.152.240/28 208.80.155.64/28 2620:0:860:201::/64 2620:0:861:202::/64 2620:0:863:201::/64 2a02:ec80:300:202::/64 2a02:ec80:700:201::/64 );
  -
  -@def $DEPLOYMENT_HOSTS = (10.64.16.93 2620:0:861:102:10:64:16:93 10.192.32.7 2620:0:860:103:10:192:32:7 );
  -@def $CUMIN_MASTERS = (10.64.16.154 2620:0:861:102:10:64:16:154 10.192.32.49 2620:0:860:103:10:192:32:49 );
  -@def $CACHES = (10.64.0.79 2620:0:861:101:10:64:0:79 10.64.0.229 2620:0:861:101:10:64:0:229 10.64.0.14 2620:0:861:101:10:64:0:14 10.64.0.51 2620:0:861:101:10:64:0:51 10.64.16.241 2620:0:861:102:10:64:16:241 10.64.16.94 2620:0:861:102:10:64:16:94 10.64.16.95 2620:0:861:102:10:64:16:95 10.64.16.240 2620:0:861:102:10:64:16:240 10.64.32.14 2620:0:861:103:10:64:32:14 10.64.32.60 2620:0:861:103:10:64:32:60 10.64.32.15 2620:0:861:103:10:64:32:15 10.64.32.65 2620:0:861:103:10:64:32:65 10.64.48.16 2620:0:861:107:10:64:48:16 10.64.48.41 2620:0:861:107:10:64:48:41 10.64.48.27 2620:0:861:107:10:64:48:27 10.64.48.28 2620:0:861:107:10:64:48:28 10.192.23.26 2620:0:860:113:10:192:23:26 10.192.6.20 2620:0:860:107:10:192:6:20 10.192.12.35 2620:0:860:10d:10:192:12:35 10.192.14.25 2620:0:860:10f:10:192:14:25 10.192.4.22 2620:0:860:100:10:192:4:22 10.192.29.26 2620:0:860:116:10:192:29:26 10.192.30.29 2620:0:860:119:10:192:30:29 10.192.36.19 2620:0:860:11b:10:192:36:19 10.192.40.25 2620:0:860:11f:10:192:40:25 10.192.41.21 2620:0:860:120:10:192:41:21 10.192.56.3 2620:0:860:12b:10:192:56:3 10.192.56.4 2620:0:860:12b:10:192:56:4 10.192.57.3 2620:0:860:12c:10:192:57:3 10.192.58.2 2620:0:860:12d:10:192:58:2 10.192.58.3 2620:0:860:12d:10:192:58:3 10.192.59.2 2620:0:860:12e:10:192:59:2 10.80.0.14 2a02:ec80:300:101:10:80:0:14 10.80.1.11 2a02:ec80:300:102:10:80:1:11 10.80.0.13 2a02:ec80:300:101:10:80:0:13 10.80.1.9 2a02:ec80:300:102:10:80:1:9 10.80.0.12 2a02:ec80:300:101:10:80:0:12 10.80.1.7 2a02:ec80:300:102:10:80:1:7 10.80.0.11 2a02:ec80:300:101:10:80:0:11 10.80.1.6 2a02:ec80:300:102:10:80:1:6 10.80.0.10 2a02:ec80:300:101:10:80:0:10 10.80.1.5 2a02:ec80:300:102:10:80:1:5 10.80.0.8 2a02:ec80:300:101:10:80:0:8 10.80.1.4 2a02:ec80:300:102:10:80:1:4 10.80.0.7 2a02:ec80:300:101:10:80:0:7 10.80.1.3 2a02:ec80:300:102:10:80:1:3 10.80.0.6 2a02:ec80:300:101:10:80:0:6 10.80.1.2 2a02:ec80:300:102:10:80:1:2 10.128.0.19 2620:0:863:101:10:128:0:19 10.128.0.27 2620:0:863:101:10:128:0:27 10.128.0.22 2620:0:863:101:10:128:0:22 10.128.0.28 2620:0:863:101:10:128:0:28 10.128.0.25 2620:0:863:101:10:128:0:25 10.128.0.29 2620:0:863:101:10:128:0:29 10.128.0.26 2620:0:863:101:10:128:0:26 10.128.0.31 2620:0:863:101:10:128:0:31 10.128.0.14 2620:0:863:101:10:128:0:14 10.128.0.35 2620:0:863:101:10:128:0:35 10.128.0.21 2620:0:863:101:10:128:0:21 10.128.0.36 2620:0:863:101:10:128:0:36 10.128.0.24 2620:0:863:101:10:128:0:24 10.128.0.10 2620:0:863:101:10:128:0:10 10.128.0.37 2620:0:863:101:10:128:0:37 10.128.0.12 2620:0:863:101:10:128:0:12 10.132.0.17 2001:df2:e500:101:10:132:0:17 10.132.0.18 2001:df2:e500:101:10:132:0:18 10.132.0.19 2001:df2:e500:101:10:132:0:19 10.132.0.24 2001:df2:e500:101:10:132:0:24 10.132.0.29 2001:df2:e500:101:10:132:0:29 10.132.0.30 2001:df2:e500:101:10:132:0:30 10.132.0.34 2001:df2:e500:101:10:132:0:34 10.132.0.35 2001:df2:e500:101:10:132:0:35 10.132.0.36 2001:df2:e500:101:10:132:0:36 10.132.0.37 2001:df2:e500:101:10:132:0:37 10.132.0.38 2001:df2:e500:101:10:132:0:38 10.132.0.25 2001:df2:e500:101:10:132:0:25 10.132.0.26 2001:df2:e500:101:10:132:0:26 10.132.0.27 2001:df2:e500:101:10:132:0:27 10.132.0.28 2001:df2:e500:101:10:132:0:28 10.132.0.16 2001:df2:e500:101:10:132:0:16 10.136.0.6 2a02:ec80:600:101:10:136:0:6 10.136.1.6 2a02:ec80:600:102:10:136:1:6 10.136.0.7 2a02:ec80:600:101:10:136:0:7 10.136.1.7 2a02:ec80:600:102:10:136:1:7 10.136.0.8 2a02:ec80:600:101:10:136:0:8 10.136.1.8 2a02:ec80:600:102:10:136:1:8 10.136.0.9 2a02:ec80:600:101:10:136:0:9 10.136.1.9 2a02:ec80:600:102:10:136:1:9 10.136.0.10 2a02:ec80:600:101:10:136:0:10 10.136.1.10 2a02:ec80:600:102:10:136:1:10 10.136.0.11 2a02:ec80:600:101:10:136:0:11 10.136.1.11 2a02:ec80:600:102:10:136:1:11 10.136.0.12 2a02:ec80:600:101:10:136:0:12 10.136.1.12 2a02:ec80:600:102:10:136:1:12 10.136.0.13 2a02:ec80:600:101:10:136:0:13 10.136.1.13 2a02:ec80:600:102:10:136:1:13 10.140.0.3 2a02:ec80:700:101:10:140:0:3 10.140.1.4 2a02:ec80:700:102:10:140:1:4 10.140.0.4 2a02:ec80:700:101:10:140:0:4 10.140.1.5 2a02:ec80:700:102:10:140:1:5 10.140.0.5 2a02:ec80:700:101:10:140:0:5 10.140.1.6 2a02:ec80:700:102:10:140:1:6 10.140.0.6 2a02:ec80:700:101:10:140:0:6 10.140.1.7 2a02:ec80:700:102:10:140:1:7 10.140.0.7 2a02:ec80:700:101:10:140:0:7 10.140.1.8 2a02:ec80:700:102:10:140:1:8 10.140.0.8 2a02:ec80:700:101:10:140:0:8 10.140.1.9 2a02:ec80:700:102:10:140:1:9 10.140.0.9 2a02:ec80:700:101:10:140:0:9 10.140.1.10 2a02:ec80:700:102:10:140:1:10 10.140.0.10 2a02:ec80:700:101:10:140:0:10 10.140.1.11 2a02:ec80:700:102:10:140:1:11 );
  -@def $LOAD_BALANCER_HEALTH_CHECKS = (10.64.0.136 10.64.16.60 10.64.158.19 10.64.166.19 10.64.133.19 10.64.141.19 10.64.169.19 10.64.171.19 10.64.173.19 10.64.175.19 10.64.177.19 10.64.179.19 10.64.181.19 10.64.183.19 10.64.185.19 10.64.187.19 10.64.189.19 10.64.48.72 10.64.37.17 10.64.1.17 10.64.17.17 10.64.33.17 10.64.130.20 10.64.131.20 10.64.132.20 10.64.134.20 10.64.135.20 10.64.136.20 10.64.158.20 10.64.166.20 10.64.133.20 10.64.141.20 10.64.169.20 10.64.171.20 10.64.173.20 10.64.175.20 10.64.177.20 10.64.179.20 10.64.181.20 10.64.183.20 10.64.185.20 10.64.187.20 10.64.189.20 2620:0:861:101::/64 2620:0:861:102::/64 2620:0:861:103::/64 2620:0:861:107::/64 2620:0:861:109::/64 2620:0:861:10a::/64 2620:0:861:10b::/64 2620:0:861:10d::/64 2620:0:861:10e::/64 2620:0:861:10f::/64 2620:0:861:119::/64 2620:0:861:10c::/64 2620:0:861:113::/64 2620:0:861:119::/64 2620:0:861:131::/64 2620:0:861:133::/64 2620:0:861:135::/64 2620:0:861:137::/64 2620:0:861:139::/64 2620:0:861:13b::/64 2620:0:861:13d::/64 2620:0:861:13f::/64 2620:0:861:142::/64 2620:0:861:144::/64 10.192.23.8 10.192.0.29 10.192.17.8 10.192.33.8 10.192.49.8 10.192.23.2 10.192.5.2 10.192.6.2 10.192.7.2 10.192.8.2 10.192.9.2 10.192.10.2 10.192.11.2 10.192.12.2 10.192.13.2 10.192.14.2 10.192.15.2 10.192.21.2 10.192.22.2 10.192.4.2 10.192.26.2 10.192.27.2 10.192.28.2 10.192.29.2 10.192.30.2 10.192.31.2 10.192.36.2 10.192.37.2 10.192.38.2 10.192.39.2 10.192.40.2 10.192.41.2 10.192.42.2 10.192.43.2 10.192.11.8 10.192.16.140 10.192.1.8 10.192.33.9 10.192.49.9 10.192.23.3 10.192.5.3 10.192.6.3 10.192.7.3 10.192.8.3 10.192.9.3 10.192.10.3 10.192.11.3 10.192.12.3 10.192.13.3 10.192.14.3 10.192.15.3 10.192.21.3 10.192.22.3 10.192.4.3 10.192.26.3 10.192.27.3 10.192.28.3 10.192.29.3 10.192.30.3 10.192.31.3 10.192.36.3 10.192.37.3 10.192.38.3 10.192.39.4 10.192.40.3 10.192.41.3 10.192.42.3 10.192.43.3 10.192.32.14 10.192.1.9 10.192.17.9 10.192.49.10 10.192.23.4 10.192.5.4 10.192.6.4 10.192.7.4 10.192.8.4 10.192.9.4 10.192.10.4 10.192.11.4 10.192.12.4 10.192.13.4 10.192.14.4 10.192.15.4 10.192.21.4 10.192.22.4 10.192.4.5 10.192.26.5 10.192.27.5 10.192.28.5 10.192.29.5 10.192.30.5 10.192.31.5 10.192.36.5 10.192.37.5 10.192.38.5 10.192.39.6 10.192.40.5 10.192.41.5 10.192.42.5 10.192.43.5 10.192.48.213 10.192.1.13 10.192.17.10 10.192.33.10 10.192.23.5 10.192.5.8 10.192.6.5 10.192.7.5 10.192.8.5 10.192.9.5 10.192.10.5 10.192.11.5 10.192.12.5 10.192.13.5 10.192.14.5 10.192.15.5 10.192.21.5 10.192.22.5 10.192.4.5 10.192.26.5 10.192.27.5 10.192.28.5 10.192.29.5 10.192.30.5 10.192.31.5 10.192.36.5 10.192.37.5 10.192.38.5 10.192.39.6 10.192.40.5 10.192.41.5 10.192.42.5 10.192.43.5 2620:0:860:101::/64 2620:0:860:102::/64 2620:0:860:103::/64 2620:0:860:104::/64 10.80.0.3 10.80.1.8 10.80.1.14 10.80.0.9 10.80.0.2 10.80.1.10 2a02:ec80:300:101::/64 2a02:ec80:300:102::/64 10.128.0.18 10.128.0.9 10.128.0.11 2620:0:863:101::/64 10.132.0.39 10.132.0.6 10.132.0.7 2001:df2:e500:101::/64 10.136.0.16 10.136.1.19 10.136.1.15 10.136.0.19 10.136.0.17 10.136.1.20 2a02:ec80:600:101::/64 2a02:ec80:600:102::/64 10.140.0.13 10.140.1.2 10.140.1.14 10.140.0.2 10.140.0.14 10.140.1.3 2a02:ec80:700:101::/64 2a02:ec80:700:102::/64 );
  -@def $KAFKA_BROKERS_MAIN = (10.192.5.9 2620:0:860:106:10:192:5:9 10.192.22.6 2620:0:860:112:10:192:22:6 10.192.32.4 2620:0:860:103:10:192:32:4 10.192.48.33 2620:0:860:104:10:192:48:33 10.192.48.35 2620:0:860:104:10:192:48:35 10.64.0.101 2620:0:861:101:10:64:0:101 10.64.16.30 2620:0:861:102:10:64:16:30 10.64.32.45 2620:0:861:103:10:64:32:45 10.64.48.37 2620:0:861:107:10:64:48:37 10.64.152.5 2620:0:861:120:10:64:152:5 );
  -@def $KAFKA_BROKERS_JUMBO = (10.64.130.10 2620:0:861:109:10:64:130:10 10.64.131.16 2620:0:861:10a:10:64:131:16 10.64.132.21 2620:0:861:10b:10:64:132:21 10.64.134.9 2620:0:861:10d:10:64:134:9 10.64.135.16 2620:0:861:10e:10:64:135:16 10.64.136.11 2620:0:861:10f:10:64:136:11 10.64.154.15 2620:0:861:122:10:64:154:15 10.64.160.16 2620:0:861:128:10:64:160:16 10.64.0.126 2620:0:861:101:10:64:0:126 );
  -@def $KAFKA_BROKERS_LOGGING = (10.64.16.205 2620:0:861:102:10:64:16:205 10.64.133.11 2620:0:861:10c:10:64:133:11 10.64.183.12 2620:0:861:13d:10:64:183:12 10.64.131.13 2620:0:861:10a:10:64:131:13 10.64.135.13 2620:0:861:10e:10:64:135:13 10.192.23.29 2620:0:860:113:10:192:23:29 10.192.11.28 2620:0:860:10c:10:192:11:28 10.192.26.22 2620:0:860:105:10:192:26:22 10.192.11.27 2620:0:860:10c:10:192:11:27 10.192.39.25 2620:0:860:11e:10:192:39:25 );
  -@def $KAFKAMON_HOSTS = (10.64.32.11 2620:0:861:103:10:64:32:11 10.192.16.139 2620:0:860:102:10:192:16:139 );
  -@def $ZOOKEEPER_HOSTS_MAIN = (10.64.0.207 2620:0:861:101:10:64:0:207 10.64.16.110 2620:0:861:102:10:64:16:110 10.64.48.154 2620:0:861:107:10:64:48:154 10.192.16.45 2620:0:860:102:10:192:16:45 10.192.32.52 2620:0:860:103:10:192:32:52 10.192.48.59 2620:0:860:104:10:192:48:59 );
  -@def $ZOOKEEPER_FLINK_HOSTS = (10.64.16.9 2620:0:861:102:10:64:16:9 10.64.0.8 2620:0:861:101:10:64:0:8 10.64.32.41 2620:0:861:103:10:64:32:41 10.192.16.227 2620:0:860:102:10:192:16:227 10.192.32.179 2620:0:860:103:10:192:32:179 10.192.48.219 2620:0:860:104:10:192:48:219 );
  -@def $DRUID_PUBLIC_HOSTS = (10.64.131.9 2620:0:861:10a:10:64:131:9 10.64.132.12 2620:0:861:10b:10:64:132:12 10.64.135.9 2620:0:861:10e:10:64:135:9 10.64.32.101 2620:0:861:103:10:64:32:101 10.64.48.185 2620:0:861:107:10:64:48:185 );
  -@def $LABSTORE_HOSTS = (208.80.154.142 2620:0:861:2:208:80:154:142 208.80.154.71 2620:0:861:3:208:80:154:71 );
  -@def $MYSQL_ROOT_CLIENTS = (10.64.16.90 10.192.16.191 10.64.16.154 10.192.32.49 208.80.155.103 208.80.154.9 10.64.0.20 );
  -
  -# Realm: cloud, # Site: codfw, # Sphere: private, # Network: cloud-codfw-bgp-private-vips
  -@def $CODFW_PRIVATE_CLOUD_CODFW_BGP_PRIVATE_VIPS_IPV4 = (172.20.254.0/24);
  -@def $CODFW_PRIVATE_CLOUD_CODFW_BGP_PRIVATE_VIPS_IPV6 = (2a02:ec80:a100:2ff::/64);
  -@def $CODFW_PRIVATE_CLOUD_CODFW_BGP_PRIVATE_VIPS = ($CODFW_PRIVATE_CLOUD_CODFW_BGP_PRIVATE_VIPS_IPV4 $CODFW_PRIVATE_CLOUD_CODFW_BGP_PRIVATE_VIPS_IPV6 );
  -
  -# Realm: cloud, # Site: codfw, # Sphere: private, # Network: cloud-instances-flat3-codfw
  -@def $CODFW_PRIVATE_CLOUD_INSTANCES_FLAT3_CODFW_IPV4 = (172.16.129.0/24);
  -@def $CODFW_PRIVATE_CLOUD_INSTANCES_FLAT3_CODFW_IPV6 = (2a02:ec80:a100:1::/64);
  -@def $CODFW_PRIVATE_CLOUD_INSTANCES_FLAT3_CODFW = ($CODFW_PRIVATE_CLOUD_INSTANCES_FLAT3_CODFW_IPV4 $CODFW_PRIVATE_CLOUD_INSTANCES_FLAT3_CODFW_IPV6 );
  -
  -# Realm: cloud, # Site: codfw, # Sphere: private, # Network: cloud-instances-octavia-lb-mgmt-net-codfw1dev
  -@def $CODFW_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_CODFW1DEV_IPV4 = (172.16.131.0/24);
  -@def $CODFW_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_CODFW1DEV_IPV6 = (2a02:ec80:a100:100::/64);
  -@def $CODFW_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_CODFW1DEV = ($CODFW_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_CODFW1DEV_IPV4 $CODFW_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_CODFW1DEV_IPV6 );
  -
  -# Realm: cloud, # Site: codfw, # Sphere: private, # Network: cloud-instances-vxlan-ipv4-only-codfw
  -@def $CODFW_PRIVATE_CLOUD_INSTANCES_VXLAN_IPV4_ONLY_CODFW_IPV4 = (172.16.130.0/24);
  -@def $CODFW_PRIVATE_CLOUD_INSTANCES_VXLAN_IPV4_ONLY_CODFW = ($CODFW_PRIVATE_CLOUD_INSTANCES_VXLAN_IPV4_ONLY_CODFW_IPV4 );
  -
  -# Realm: cloud, # Site: codfw, # Sphere: private, # Network: cloud-instances2-b-codfw
  -@def $CODFW_PRIVATE_CLOUD_INSTANCES2_B_CODFW_IPV4 = (172.16.128.0/24);
  -@def $CODFW_PRIVATE_CLOUD_INSTANCES2_B_CODFW = ($CODFW_PRIVATE_CLOUD_INSTANCES2_B_CODFW_IPV4 );
  -
  -# Realm: cloud, # Site: codfw, # Sphere: private, # Network: cloud-private-b1-codfw
  -@def $CODFW_PRIVATE_CLOUD_PRIVATE_B1_CODFW_IPV4 = (172.20.5.0/24);
  -@def $CODFW_PRIVATE_CLOUD_PRIVATE_B1_CODFW_IPV6 = (2a02:ec80:a100:205::/64);
  -@def $CODFW_PRIVATE_CLOUD_PRIVATE_B1_CODFW = ($CODFW_PRIVATE_CLOUD_PRIVATE_B1_CODFW_IPV4 $CODFW_PRIVATE_CLOUD_PRIVATE_B1_CODFW_IPV6 );
  -
  -# Realm: cloud, # Site: codfw, # Sphere: public, # Network: cloud-codfw1dev-bgp-public-vips
  -@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_BGP_PUBLIC_VIPS_IPV4 = (185.15.57.24/29);
  -@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_BGP_PUBLIC_VIPS_IPV6 = (2a02:ec80:a100:4000::/64);
  -@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_BGP_PUBLIC_VIPS = ($CODFW_PUBLIC_CLOUD_CODFW1DEV_BGP_PUBLIC_VIPS_IPV4 $CODFW_PUBLIC_CLOUD_CODFW1DEV_BGP_PUBLIC_VIPS_IPV6 );
  -
  -# Realm: cloud, # Site: codfw, # Sphere: public, # Network: cloud-codfw1dev-floating
  -@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_FLOATING_IPV4 = (185.15.57.0/29);
  -@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_FLOATING = ($CODFW_PUBLIC_CLOUD_CODFW1DEV_FLOATING_IPV4 );
  -
  -# Realm: cloud, # Site: codfw, # Sphere: public, # Network: cloud-codfw1dev-floating-additional
  -@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_FLOATING_ADDITIONAL_IPV4 = (185.15.57.16/29);
  -@def $CODFW_PUBLIC_CLOUD_CODFW1DEV_FLOATING_ADDITIONAL = ($CODFW_PUBLIC_CLOUD_CODFW1DEV_FLOATING_ADDITIONAL_IPV4 );
  -
  -# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-eqiad-bgp-private-vips
  -@def $EQIAD_PRIVATE_CLOUD_EQIAD_BGP_PRIVATE_VIPS_IPV4 = (172.20.255.0/24);
  -@def $EQIAD_PRIVATE_CLOUD_EQIAD_BGP_PRIVATE_VIPS_IPV6 = (2a02:ec80:a000:2ff::/64);
  -@def $EQIAD_PRIVATE_CLOUD_EQIAD_BGP_PRIVATE_VIPS = ($EQIAD_PRIVATE_CLOUD_EQIAD_BGP_PRIVATE_VIPS_IPV4 $EQIAD_PRIVATE_CLOUD_EQIAD_BGP_PRIVATE_VIPS_IPV6 );
  -
  -# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-instances-octavia-lb-mgmt-net-eqiad1
  -@def $EQIAD_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_EQIAD1_IPV4 = (172.16.24.0/24);
  -@def $EQIAD_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_EQIAD1_IPV6 = (2a02:ec80:a000:100::/64);
  -@def $EQIAD_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_EQIAD1 = ($EQIAD_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_EQIAD1_IPV4 $EQIAD_PRIVATE_CLOUD_INSTANCES_OCTAVIA_LB_MGMT_NET_EQIAD1_IPV6 );
  -
  -# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-instances-vxlan-dualstack-eqiad
  -@def $EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_DUALSTACK_EQIAD_IPV4 = (172.16.16.0/21);
  -@def $EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_DUALSTACK_EQIAD_IPV6 = (2a02:ec80:a000:1::/64);
  -@def $EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_DUALSTACK_EQIAD = ($EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_DUALSTACK_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_DUALSTACK_EQIAD_IPV6 );
  -
  -# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-instances-vxlan-v4only-eqiad
  -@def $EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_V4ONLY_EQIAD_IPV4 = (172.16.8.0/21);
  -@def $EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_V4ONLY_EQIAD = ($EQIAD_PRIVATE_CLOUD_INSTANCES_VXLAN_V4ONLY_EQIAD_IPV4 );
  -
  -# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-instances2-b-eqiad
  -@def $EQIAD_PRIVATE_CLOUD_INSTANCES2_B_EQIAD_IPV4 = (172.16.0.0/21);
  -@def $EQIAD_PRIVATE_CLOUD_INSTANCES2_B_EQIAD = ($EQIAD_PRIVATE_CLOUD_INSTANCES2_B_EQIAD_IPV4 );
  -
  -# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-private-c8-eqiad
  -@def $EQIAD_PRIVATE_CLOUD_PRIVATE_C8_EQIAD_IPV4 = (172.20.1.0/24);
  -@def $EQIAD_PRIVATE_CLOUD_PRIVATE_C8_EQIAD_IPV6 = (2a02:ec80:a000:201::/64);
  -@def $EQIAD_PRIVATE_CLOUD_PRIVATE_C8_EQIAD = ($EQIAD_PRIVATE_CLOUD_PRIVATE_C8_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_PRIVATE_C8_EQIAD_IPV6 );
  -
  -# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-private-d5-eqiad
  -@def $EQIAD_PRIVATE_CLOUD_PRIVATE_D5_EQIAD_IPV4 = (172.20.2.0/24);
  -@def $EQIAD_PRIVATE_CLOUD_PRIVATE_D5_EQIAD_IPV6 = (2a02:ec80:a000:202::/64);
  -@def $EQIAD_PRIVATE_CLOUD_PRIVATE_D5_EQIAD = ($EQIAD_PRIVATE_CLOUD_PRIVATE_D5_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_PRIVATE_D5_EQIAD_IPV6 );
  -
  -# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-private-e4-eqiad
  -@def $EQIAD_PRIVATE_CLOUD_PRIVATE_E4_EQIAD_IPV4 = (172.20.3.0/24);
  -@def $EQIAD_PRIVATE_CLOUD_PRIVATE_E4_EQIAD_IPV6 = (2a02:ec80:a000:203::/64);
  -@def $EQIAD_PRIVATE_CLOUD_PRIVATE_E4_EQIAD = ($EQIAD_PRIVATE_CLOUD_PRIVATE_E4_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_PRIVATE_E4_EQIAD_IPV6 );
  -
  -# Realm: cloud, # Site: eqiad, # Sphere: private, # Network: cloud-private-f4-eqiad
  -@def $EQIAD_PRIVATE_CLOUD_PRIVATE_F4_EQIAD_IPV4 = (172.20.4.0/24);
  -@def $EQIAD_PRIVATE_CLOUD_PRIVATE_F4_EQIAD_IPV6 = (2a02:ec80:a000:204::/64);
  -@def $EQIAD_PRIVATE_CLOUD_PRIVATE_F4_EQIAD = ($EQIAD_PRIVATE_CLOUD_PRIVATE_F4_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_PRIVATE_F4_EQIAD_IPV6 );
  -
  -# Realm: cloud, # Site: eqiad, # Sphere: public, # Network: cloud-eqiad1-bgp-public-vips
  -@def $EQIAD_PUBLIC_CLOUD_EQIAD1_BGP_PUBLIC_VIPS_IPV4 = (185.15.56.160/28);
  -@def $EQIAD_PUBLIC_CLOUD_EQIAD1_BGP_PUBLIC_VIPS_IPV6 = (2a02:ec80:a000:4000::/64);
  -@def $EQIAD_PUBLIC_CLOUD_EQIAD1_BGP_PUBLIC_VIPS = ($EQIAD_PUBLIC_CLOUD_EQIAD1_BGP_PUBLIC_VIPS_IPV4 $EQIAD_PUBLIC_CLOUD_EQIAD1_BGP_PUBLIC_VIPS_IPV6 );
  -
  -# Realm: cloud, # Site: eqiad, # Sphere: public, # Network: cloud-eqiad1-floating
  -@def $EQIAD_PUBLIC_CLOUD_EQIAD1_FLOATING_IPV4 = (185.15.56.0/25);
  -@def $EQIAD_PUBLIC_CLOUD_EQIAD1_FLOATING = ($EQIAD_PUBLIC_CLOUD_EQIAD1_FLOATING_IPV4 );
  -
  -# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-administration-codfw
  -@def $CODFW_PRIVATE_FRACK_ADMINISTRATION_CODFW_IPV4 = (10.195.0.64/28);
  -@def $CODFW_PRIVATE_FRACK_ADMINISTRATION_CODFW = ($CODFW_PRIVATE_FRACK_ADMINISTRATION_CODFW_IPV4 );
  -
  -# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-bastion-codfw
  -@def $CODFW_PRIVATE_FRACK_BASTION_CODFW_IPV4 = (10.195.0.128/29);
  -@def $CODFW_PRIVATE_FRACK_BASTION_CODFW = ($CODFW_PRIVATE_FRACK_BASTION_CODFW_IPV4 );
  -
  -# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-fundraising-codfw
  -@def $CODFW_PRIVATE_FRACK_FUNDRAISING_CODFW_IPV4 = (10.195.0.32/27);
  -@def $CODFW_PRIVATE_FRACK_FUNDRAISING_CODFW = ($CODFW_PRIVATE_FRACK_FUNDRAISING_CODFW_IPV4 );
  -
  -# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-listenerdmz-codfw
  -@def $CODFW_PRIVATE_FRACK_LISTENERDMZ_CODFW_IPV4 = (10.195.0.80/29);
  -@def $CODFW_PRIVATE_FRACK_LISTENERDMZ_CODFW = ($CODFW_PRIVATE_FRACK_LISTENERDMZ_CODFW_IPV4 );
  -
  -# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-management-codfw
  -@def $CODFW_PRIVATE_FRACK_MANAGEMENT_CODFW_IPV4 = (10.195.1.0/25);
  -@def $CODFW_PRIVATE_FRACK_MANAGEMENT_CODFW = ($CODFW_PRIVATE_FRACK_MANAGEMENT_CODFW_IPV4 );
  -
  -# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-management-legacy-codfw
  -@def $CODFW_PRIVATE_FRACK_MANAGEMENT_LEGACY_CODFW_IPV4 = (10.195.0.96/27);
  -@def $CODFW_PRIVATE_FRACK_MANAGEMENT_LEGACY_CODFW = ($CODFW_PRIVATE_FRACK_MANAGEMENT_LEGACY_CODFW_IPV4 );
  -
  -# Realm: frack, # Site: codfw, # Sphere: private, # Network: frack-payments-codfw
  -@def $CODFW_PRIVATE_FRACK_PAYMENTS_CODFW_IPV4 = (10.195.0.0/27);
  -@def $CODFW_PRIVATE_FRACK_PAYMENTS_CODFW = ($CODFW_PRIVATE_FRACK_PAYMENTS_CODFW_IPV4 );
  -
  -# Realm: frack, # Site: codfw, # Sphere: public, # Network: frack-external-codfw
  -@def $CODFW_PUBLIC_FRACK_EXTERNAL_CODFW_IPV4 = (208.80.152.224/28);
  -@def $CODFW_PUBLIC_FRACK_EXTERNAL_CODFW = ($CODFW_PUBLIC_FRACK_EXTERNAL_CODFW_IPV4 );
  -
  -# Realm: frack, # Site: eqiad, # Sphere: private, # Network: frack-administration1-e15-eqiad
  -@def $EQIAD_PRIVATE_FRACK_ADMINISTRATION1_E15_EQIAD_IPV4 = (10.64.40.64/27);
  -@def $EQIAD_PRIVATE_FRACK_ADMINISTRATION1_E15_EQIAD = ($EQIAD_PRIVATE_FRACK_ADMINISTRATION1_E15_EQIAD_IPV4 );
  -
  -# Realm: frack, # Site: eqiad, # Sphere: private, # Network: frack-bastion1-e15-eqiad
  -@def $EQIAD_PRIVATE_FRACK_BASTION1_E15_EQIAD_IPV4 = (10.64.40.32/27);
  -@def $EQIAD_PRIVATE_FRACK_BASTION1_E15_EQIAD = ($EQIAD_PRIVATE_FRACK_BASTION1_E15_EQIAD_IPV4 );
  -
  -# Realm: frack, # Site: eqiad, # Sphere: private, # Network: frack-fundraising1-e16-eqiad
  -@def $EQIAD_PRIVATE_FRACK_FUNDRAISING1_E16_EQIAD_IPV4 = (10.64.40.96/27);
  -@def $EQIAD_PRIVATE_FRACK_FUNDRAISING1_E16_EQIAD = ($EQIAD_PRIVATE_FRACK_FUNDRAISING1_E16_EQIAD_IPV4 );
  -
  -# Realm: frack, # Site: eqiad, # Sphere: private, # Network: frack-listenerdmz1-e15-eqiad
  -@def $EQIAD_PRIVATE_FRACK_LISTENERDMZ1_E15_EQIAD_IPV4 = (10.64.40.160/27);
  -@def $EQIAD_PRIVATE_FRACK_LISTENERDMZ1_E15_EQIAD = ($EQIAD_PRIVATE_FRACK_LISTENERDMZ1_E15_EQIAD_IPV4 );
  -
  -# Realm: frack, # Site: eqiad, # Sphere: private, # Network: frack-management1-eqiad
  -@def $EQIAD_PRIVATE_FRACK_MANAGEMENT1_EQIAD_IPV4 = (10.64.40.192/26);
  -@def $EQIAD_PRIVATE_FRACK_MANAGEMENT1_EQIAD = ($EQIAD_PRIVATE_FRACK_MANAGEMENT1_EQIAD_IPV4 );
  -
  -# Realm: frack, # Site: eqiad, # Sphere: private, # Network: frack-payments1-e15-eqiad
  -@def $EQIAD_PRIVATE_FRACK_PAYMENTS1_E15_EQIAD_IPV4 = (10.64.40.0/27);
  -@def $EQIAD_PRIVATE_FRACK_PAYMENTS1_E15_EQIAD = ($EQIAD_PRIVATE_FRACK_PAYMENTS1_E15_EQIAD_IPV4 );
  -
  -# Realm: frack, # Site: eqiad, # Sphere: public, # Network: frack-external1-eqiad
  -@def $EQIAD_PUBLIC_FRACK_EXTERNAL1_EQIAD_IPV4 = (208.80.155.0/27);
  -@def $EQIAD_PUBLIC_FRACK_EXTERNAL1_EQIAD = ($EQIAD_PUBLIC_FRACK_EXTERNAL1_EQIAD_IPV4 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: cloud-hosts1-b1-codfw
  -@def $CODFW_PRIVATE_CLOUD_HOSTS1_B1_CODFW_IPV4 = (10.192.20.0/24);
  -@def $CODFW_PRIVATE_CLOUD_HOSTS1_B1_CODFW_IPV6 = (2620:0:860:118::/64);
  -@def $CODFW_PRIVATE_CLOUD_HOSTS1_B1_CODFW = ($CODFW_PRIVATE_CLOUD_HOSTS1_B1_CODFW_IPV4 $CODFW_PRIVATE_CLOUD_HOSTS1_B1_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_A_CODFW_IPV4 = (10.192.0.0/22);
  -@def $CODFW_PRIVATE_PRIVATE1_A_CODFW_IPV6 = (2620:0:860:101::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_A_CODFW = ($CODFW_PRIVATE_PRIVATE1_A_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a2-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_A2_CODFW_IPV4 = (10.192.23.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_A2_CODFW_IPV6 = (2620:0:860:113::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_A2_CODFW = ($CODFW_PRIVATE_PRIVATE1_A2_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A2_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a3-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_A3_CODFW_IPV4 = (10.192.5.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_A3_CODFW_IPV6 = (2620:0:860:106::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_A3_CODFW = ($CODFW_PRIVATE_PRIVATE1_A3_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A3_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a4-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_A4_CODFW_IPV4 = (10.192.6.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_A4_CODFW_IPV6 = (2620:0:860:107::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_A4_CODFW = ($CODFW_PRIVATE_PRIVATE1_A4_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A4_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a5-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_A5_CODFW_IPV4 = (10.192.7.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_A5_CODFW_IPV6 = (2620:0:860:108::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_A5_CODFW = ($CODFW_PRIVATE_PRIVATE1_A5_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A5_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a6-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_A6_CODFW_IPV4 = (10.192.8.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_A6_CODFW_IPV6 = (2620:0:860:109::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_A6_CODFW = ($CODFW_PRIVATE_PRIVATE1_A6_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A6_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a7-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_A7_CODFW_IPV4 = (10.192.9.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_A7_CODFW_IPV6 = (2620:0:860:10a::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_A7_CODFW = ($CODFW_PRIVATE_PRIVATE1_A7_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A7_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-a8-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_A8_CODFW_IPV4 = (10.192.10.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_A8_CODFW_IPV6 = (2620:0:860:10b::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_A8_CODFW = ($CODFW_PRIVATE_PRIVATE1_A8_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_A8_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-aux-kubepods-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_AUX_KUBEPODS_CODFW_IPV4 = (10.194.80.0/21);
  -@def $CODFW_PRIVATE_PRIVATE1_AUX_KUBEPODS_CODFW_IPV6 = (2620:0:860:305::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_AUX_KUBEPODS_CODFW = ($CODFW_PRIVATE_PRIVATE1_AUX_KUBEPODS_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_AUX_KUBEPODS_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-aux-kubesvc-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_AUX_KUBESVC_CODFW_IPV4 = (10.194.64.0/20);
  -@def $CODFW_PRIVATE_PRIVATE1_AUX_KUBESVC_CODFW_IPV6 = (2620:0:860:304::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_AUX_KUBESVC_CODFW = ($CODFW_PRIVATE_PRIVATE1_AUX_KUBESVC_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_AUX_KUBESVC_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_B_CODFW_IPV4 = (10.192.16.0/22);
  -@def $CODFW_PRIVATE_PRIVATE1_B_CODFW_IPV6 = (2620:0:860:102::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_B_CODFW = ($CODFW_PRIVATE_PRIVATE1_B_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b2-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_B2_CODFW_IPV4 = (10.192.11.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_B2_CODFW_IPV6 = (2620:0:860:10c::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_B2_CODFW = ($CODFW_PRIVATE_PRIVATE1_B2_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B2_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b3-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_B3_CODFW_IPV4 = (10.192.12.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_B3_CODFW_IPV6 = (2620:0:860:10d::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_B3_CODFW = ($CODFW_PRIVATE_PRIVATE1_B3_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B3_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b4-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_B4_CODFW_IPV4 = (10.192.13.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_B4_CODFW_IPV6 = (2620:0:860:10e::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_B4_CODFW = ($CODFW_PRIVATE_PRIVATE1_B4_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B4_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b5-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_B5_CODFW_IPV4 = (10.192.14.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_B5_CODFW_IPV6 = (2620:0:860:10f::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_B5_CODFW = ($CODFW_PRIVATE_PRIVATE1_B5_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B5_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b6-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_B6_CODFW_IPV4 = (10.192.15.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_B6_CODFW_IPV6 = (2620:0:860:110::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_B6_CODFW = ($CODFW_PRIVATE_PRIVATE1_B6_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B6_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b7-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_B7_CODFW_IPV4 = (10.192.21.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_B7_CODFW_IPV6 = (2620:0:860:111::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_B7_CODFW = ($CODFW_PRIVATE_PRIVATE1_B7_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B7_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-b8-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_B8_CODFW_IPV4 = (10.192.22.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_B8_CODFW_IPV6 = (2620:0:860:112::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_B8_CODFW = ($CODFW_PRIVATE_PRIVATE1_B8_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_B8_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_C_CODFW_IPV4 = (10.192.32.0/22);
  -@def $CODFW_PRIVATE_PRIVATE1_C_CODFW_IPV6 = (2620:0:860:103::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_C_CODFW = ($CODFW_PRIVATE_PRIVATE1_C_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c1-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_C1_CODFW_IPV4 = (10.192.4.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_C1_CODFW_IPV6 = (2620:0:860:100::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_C1_CODFW = ($CODFW_PRIVATE_PRIVATE1_C1_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C1_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c2-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_C2_CODFW_IPV4 = (10.192.26.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_C2_CODFW_IPV6 = (2620:0:860:105::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_C2_CODFW = ($CODFW_PRIVATE_PRIVATE1_C2_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C2_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c3-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_C3_CODFW_IPV4 = (10.192.27.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_C3_CODFW_IPV6 = (2620:0:860:114::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_C3_CODFW = ($CODFW_PRIVATE_PRIVATE1_C3_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C3_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c4-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_C4_CODFW_IPV4 = (10.192.28.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_C4_CODFW_IPV6 = (2620:0:860:115::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_C4_CODFW = ($CODFW_PRIVATE_PRIVATE1_C4_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C4_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c5-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_C5_CODFW_IPV4 = (10.192.29.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_C5_CODFW_IPV6 = (2620:0:860:116::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_C5_CODFW = ($CODFW_PRIVATE_PRIVATE1_C5_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C5_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c6-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_C6_CODFW_IPV4 = (10.192.30.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_C6_CODFW_IPV6 = (2620:0:860:119::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_C6_CODFW = ($CODFW_PRIVATE_PRIVATE1_C6_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C6_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-c7-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_C7_CODFW_IPV4 = (10.192.31.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_C7_CODFW_IPV6 = (2620:0:860:11a::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_C7_CODFW = ($CODFW_PRIVATE_PRIVATE1_C7_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_C7_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_D_CODFW_IPV4 = (10.192.48.0/22);
  -@def $CODFW_PRIVATE_PRIVATE1_D_CODFW_IPV6 = (2620:0:860:104::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_D_CODFW = ($CODFW_PRIVATE_PRIVATE1_D_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d1-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_D1_CODFW_IPV4 = (10.192.36.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_D1_CODFW_IPV6 = (2620:0:860:11b::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_D1_CODFW = ($CODFW_PRIVATE_PRIVATE1_D1_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D1_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d2-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_D2_CODFW_IPV4 = (10.192.37.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_D2_CODFW_IPV6 = (2620:0:860:11c::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_D2_CODFW = ($CODFW_PRIVATE_PRIVATE1_D2_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D2_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d3-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_D3_CODFW_IPV4 = (10.192.38.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_D3_CODFW_IPV6 = (2620:0:860:11d::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_D3_CODFW = ($CODFW_PRIVATE_PRIVATE1_D3_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D3_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d4-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_D4_CODFW_IPV4 = (10.192.39.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_D4_CODFW_IPV6 = (2620:0:860:11e::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_D4_CODFW = ($CODFW_PRIVATE_PRIVATE1_D4_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D4_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d5-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_D5_CODFW_IPV4 = (10.192.40.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_D5_CODFW_IPV6 = (2620:0:860:11f::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_D5_CODFW = ($CODFW_PRIVATE_PRIVATE1_D5_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D5_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d6-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_D6_CODFW_IPV4 = (10.192.41.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_D6_CODFW_IPV6 = (2620:0:860:120::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_D6_CODFW = ($CODFW_PRIVATE_PRIVATE1_D6_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D6_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d7-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_D7_CODFW_IPV4 = (10.192.42.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_D7_CODFW_IPV6 = (2620:0:860:121::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_D7_CODFW = ($CODFW_PRIVATE_PRIVATE1_D7_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D7_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-d8-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_D8_CODFW_IPV4 = (10.192.43.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_D8_CODFW_IPV6 = (2620:0:860:122::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_D8_CODFW = ($CODFW_PRIVATE_PRIVATE1_D8_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_D8_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-dse-kubepods-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_DSE_KUBEPODS_CODFW_IPV4 = (10.192.96.0/21);
  -@def $CODFW_PRIVATE_PRIVATE1_DSE_KUBEPODS_CODFW_IPV6 = (2620:0:860:308::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_DSE_KUBEPODS_CODFW = ($CODFW_PRIVATE_PRIVATE1_DSE_KUBEPODS_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_DSE_KUBEPODS_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-dse-kubesvc-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_DSE_KUBESVC_CODFW_IPV4 = (10.192.80.0/20);
  -@def $CODFW_PRIVATE_PRIVATE1_DSE_KUBESVC_CODFW_IPV6 = (2620:0:860:307::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_DSE_KUBESVC_CODFW = ($CODFW_PRIVATE_PRIVATE1_DSE_KUBESVC_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_DSE_KUBESVC_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-e1-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_E1_CODFW_IPV4 = (10.192.56.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_E1_CODFW_IPV6 = (2620:0:860:12b::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_E1_CODFW = ($CODFW_PRIVATE_PRIVATE1_E1_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_E1_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-e2-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_E2_CODFW_IPV4 = (10.192.44.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_E2_CODFW_IPV6 = (2620:0:860:123::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_E2_CODFW = ($CODFW_PRIVATE_PRIVATE1_E2_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_E2_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-e3-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_E3_CODFW_IPV4 = (10.192.57.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_E3_CODFW_IPV6 = (2620:0:860:12c::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_E3_CODFW = ($CODFW_PRIVATE_PRIVATE1_E3_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_E3_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-e4-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_E4_CODFW_IPV4 = (10.192.45.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_E4_CODFW_IPV6 = (2620:0:860:124::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_E4_CODFW = ($CODFW_PRIVATE_PRIVATE1_E4_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_E4_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-e5-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_E5_CODFW_IPV4 = (10.192.46.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_E5_CODFW_IPV6 = (2620:0:860:125::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_E5_CODFW = ($CODFW_PRIVATE_PRIVATE1_E5_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_E5_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-f1-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_F1_CODFW_IPV4 = (10.192.58.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_F1_CODFW_IPV6 = (2620:0:860:12d::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_F1_CODFW = ($CODFW_PRIVATE_PRIVATE1_F1_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_F1_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-f2-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_F2_CODFW_IPV4 = (10.192.47.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_F2_CODFW_IPV6 = (2620:0:860:126::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_F2_CODFW = ($CODFW_PRIVATE_PRIVATE1_F2_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_F2_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-f3-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_F3_CODFW_IPV4 = (10.192.59.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_F3_CODFW_IPV6 = (2620:0:860:12e::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_F3_CODFW = ($CODFW_PRIVATE_PRIVATE1_F3_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_F3_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-f4-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_F4_CODFW_IPV4 = (10.192.52.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_F4_CODFW_IPV6 = (2620:0:860:127::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_F4_CODFW = ($CODFW_PRIVATE_PRIVATE1_F4_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_F4_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-lvs-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_LVS_CODFW_IPV4 = (10.2.1.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_LVS_CODFW = ($CODFW_PRIVATE_PRIVATE1_LVS_CODFW_IPV4 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-mlserve-kubepods-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_CODFW_IPV4 = (10.194.16.0/21);
  -@def $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_CODFW_IPV6 = (2620:0:860:300::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_CODFW = ($CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-mlserve-kubesvc-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_CODFW_IPV4 = (10.194.0.0/20);
  -@def $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_CODFW_IPV6 = (2620:0:860:301::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_CODFW = ($CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-mlstage-kubepods-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBEPODS_CODFW_IPV4 = (10.194.61.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBEPODS_CODFW_IPV6 = (2620:0:860:302::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBEPODS_CODFW = ($CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBEPODS_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBEPODS_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-mlstage-kubesvc-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBESVC_CODFW_IPV4 = (10.194.62.0/23);
  -@def $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBESVC_CODFW_IPV6 = (2620:0:860:303::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBESVC_CODFW = ($CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBESVC_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_MLSTAGE_KUBESVC_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-services-kubepods-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_CODFW_IPV4 = (10.194.128.0/17);
  -@def $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_CODFW_IPV6 = (2620:0:860:cabe::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_CODFW = ($CODFW_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-services-kubesvc-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBESVC_CODFW_IPV4 = (10.192.72.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBESVC_CODFW_IPV6 = (2620:0:860:cabf::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBESVC_CODFW = ($CODFW_PRIVATE_PRIVATE1_SERVICES_KUBESVC_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_SERVICES_KUBESVC_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-staging-kubepods-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_STAGING_KUBEPODS_CODFW_IPV4 = (10.192.64.0/21);
  -@def $CODFW_PRIVATE_PRIVATE1_STAGING_KUBEPODS_CODFW_IPV6 = (2620:0:860:babe::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_STAGING_KUBEPODS_CODFW = ($CODFW_PRIVATE_PRIVATE1_STAGING_KUBEPODS_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_STAGING_KUBEPODS_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-staging-kubesvc-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_STAGING_KUBESVC_CODFW_IPV4 = (10.192.76.0/24);
  -@def $CODFW_PRIVATE_PRIVATE1_STAGING_KUBESVC_CODFW_IPV6 = (2620:0:860:babf::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_STAGING_KUBESVC_CODFW = ($CODFW_PRIVATE_PRIVATE1_STAGING_KUBESVC_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_STAGING_KUBESVC_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: private, # Network: private1-virtual-codfw
  -@def $CODFW_PRIVATE_PRIVATE1_VIRTUAL_CODFW_IPV4 = (10.192.24.0/23);
  -@def $CODFW_PRIVATE_PRIVATE1_VIRTUAL_CODFW_IPV6 = (2620:0:860:140::/64);
  -@def $CODFW_PRIVATE_PRIVATE1_VIRTUAL_CODFW = ($CODFW_PRIVATE_PRIVATE1_VIRTUAL_CODFW_IPV4 $CODFW_PRIVATE_PRIVATE1_VIRTUAL_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: public, # Network: public1-a-codfw
  -@def $CODFW_PUBLIC_PUBLIC1_A_CODFW_IPV4 = (208.80.153.0/27);
  -@def $CODFW_PUBLIC_PUBLIC1_A_CODFW_IPV6 = (2620:0:860:1::/64);
  -@def $CODFW_PUBLIC_PUBLIC1_A_CODFW = ($CODFW_PUBLIC_PUBLIC1_A_CODFW_IPV4 $CODFW_PUBLIC_PUBLIC1_A_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: public, # Network: public1-b-codfw
  -@def $CODFW_PUBLIC_PUBLIC1_B_CODFW_IPV4 = (208.80.153.32/27);
  -@def $CODFW_PUBLIC_PUBLIC1_B_CODFW_IPV6 = (2620:0:860:2::/64);
  -@def $CODFW_PUBLIC_PUBLIC1_B_CODFW = ($CODFW_PUBLIC_PUBLIC1_B_CODFW_IPV4 $CODFW_PUBLIC_PUBLIC1_B_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: public, # Network: public1-c-codfw
  -@def $CODFW_PUBLIC_PUBLIC1_C_CODFW_IPV4 = (208.80.153.64/27);
  -@def $CODFW_PUBLIC_PUBLIC1_C_CODFW_IPV6 = (2620:0:860:3::/64);
  -@def $CODFW_PUBLIC_PUBLIC1_C_CODFW = ($CODFW_PUBLIC_PUBLIC1_C_CODFW_IPV4 $CODFW_PUBLIC_PUBLIC1_C_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: public, # Network: public1-d-codfw
  -@def $CODFW_PUBLIC_PUBLIC1_D_CODFW_IPV4 = (208.80.153.96/27);
  -@def $CODFW_PUBLIC_PUBLIC1_D_CODFW_IPV6 = (2620:0:860:4::/64);
  -@def $CODFW_PUBLIC_PUBLIC1_D_CODFW = ($CODFW_PUBLIC_PUBLIC1_D_CODFW_IPV4 $CODFW_PUBLIC_PUBLIC1_D_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: public, # Network: public1-lvs-codfw
  -@def $CODFW_PUBLIC_PUBLIC1_LVS_CODFW_IPV4 = (208.80.153.224/27);
  -@def $CODFW_PUBLIC_PUBLIC1_LVS_CODFW_IPV6 = (2620:0:860:ed1a::/64);
  -@def $CODFW_PUBLIC_PUBLIC1_LVS_CODFW = ($CODFW_PUBLIC_PUBLIC1_LVS_CODFW_IPV4 $CODFW_PUBLIC_PUBLIC1_LVS_CODFW_IPV6 );
  -
  -# Realm: production, # Site: codfw, # Sphere: public, # Network: public1-virtual-codfw
  -@def $CODFW_PUBLIC_PUBLIC1_VIRTUAL_CODFW_IPV4 = (208.80.152.128/27);
  -@def $CODFW_PUBLIC_PUBLIC1_VIRTUAL_CODFW_IPV6 = (2620:0:860:5::/64);
  -@def $CODFW_PUBLIC_PUBLIC1_VIRTUAL_CODFW = ($CODFW_PUBLIC_PUBLIC1_VIRTUAL_CODFW_IPV4 $CODFW_PUBLIC_PUBLIC1_VIRTUAL_CODFW_IPV6 );
  -
  -# Realm: production, # Site: drmrs, # Sphere: private, # Network: private1-b12-drmrs
  -@def $DRMRS_PRIVATE_PRIVATE1_B12_DRMRS_IPV4 = (10.136.0.0/24);
  -@def $DRMRS_PRIVATE_PRIVATE1_B12_DRMRS_IPV6 = (2a02:ec80:600:101::/64);
  -@def $DRMRS_PRIVATE_PRIVATE1_B12_DRMRS = ($DRMRS_PRIVATE_PRIVATE1_B12_DRMRS_IPV4 $DRMRS_PRIVATE_PRIVATE1_B12_DRMRS_IPV6 );
  -
  -# Realm: production, # Site: drmrs, # Sphere: private, # Network: private1-b13-drmrs
  -@def $DRMRS_PRIVATE_PRIVATE1_B13_DRMRS_IPV4 = (10.136.1.0/24);
  -@def $DRMRS_PRIVATE_PRIVATE1_B13_DRMRS_IPV6 = (2a02:ec80:600:102::/64);
  -@def $DRMRS_PRIVATE_PRIVATE1_B13_DRMRS = ($DRMRS_PRIVATE_PRIVATE1_B13_DRMRS_IPV4 $DRMRS_PRIVATE_PRIVATE1_B13_DRMRS_IPV6 );
  -
  -# Realm: production, # Site: drmrs, # Sphere: private, # Network: private1-lvs-drmrs
  -@def $DRMRS_PRIVATE_PRIVATE1_LVS_DRMRS_IPV4 = (10.2.6.0/24);
  -@def $DRMRS_PRIVATE_PRIVATE1_LVS_DRMRS = ($DRMRS_PRIVATE_PRIVATE1_LVS_DRMRS_IPV4 );
  -
  -# Realm: production, # Site: drmrs, # Sphere: public, # Network: public1-b12-drmrs
  -@def $DRMRS_PUBLIC_PUBLIC1_B12_DRMRS_IPV4 = (185.15.58.0/27);
  -@def $DRMRS_PUBLIC_PUBLIC1_B12_DRMRS_IPV6 = (2a02:ec80:600:1::/64);
  -@def $DRMRS_PUBLIC_PUBLIC1_B12_DRMRS = ($DRMRS_PUBLIC_PUBLIC1_B12_DRMRS_IPV4 $DRMRS_PUBLIC_PUBLIC1_B12_DRMRS_IPV6 );
  -
  -# Realm: production, # Site: drmrs, # Sphere: public, # Network: public1-b13-drmrs
  -@def $DRMRS_PUBLIC_PUBLIC1_B13_DRMRS_IPV4 = (185.15.58.32/27);
  -@def $DRMRS_PUBLIC_PUBLIC1_B13_DRMRS_IPV6 = (2a02:ec80:600:2::/64);
  -@def $DRMRS_PUBLIC_PUBLIC1_B13_DRMRS = ($DRMRS_PUBLIC_PUBLIC1_B13_DRMRS_IPV4 $DRMRS_PUBLIC_PUBLIC1_B13_DRMRS_IPV6 );
  -
  -# Realm: production, # Site: drmrs, # Sphere: public, # Network: public1-lvs-drmrs
  -@def $DRMRS_PUBLIC_PUBLIC1_LVS_DRMRS_IPV4 = (185.15.58.224/27);
  -@def $DRMRS_PUBLIC_PUBLIC1_LVS_DRMRS_IPV6 = (2a02:ec80:600:ed1a::/64);
  -@def $DRMRS_PUBLIC_PUBLIC1_LVS_DRMRS = ($DRMRS_PUBLIC_PUBLIC1_LVS_DRMRS_IPV4 $DRMRS_PUBLIC_PUBLIC1_LVS_DRMRS_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-a-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_A_EQIAD_IPV4 = (10.64.5.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_A_EQIAD_IPV6 = (2620:0:861:104::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_A_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_A_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_A_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-b-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_B_EQIAD_IPV4 = (10.64.21.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_B_EQIAD_IPV6 = (2620:0:861:105::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_B_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_B_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_B_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_C_EQIAD_IPV4 = (10.64.36.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C_EQIAD_IPV6 = (2620:0:861:106::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c2-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_C2_EQIAD_IPV4 = (10.64.137.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C2_EQIAD_IPV6 = (2620:0:861:110::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C2_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C2_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C2_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c3-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_C3_EQIAD_IPV4 = (10.64.145.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C3_EQIAD_IPV6 = (2620:0:861:117::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C3_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C3_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C3_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c4-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_C4_EQIAD_IPV4 = (10.64.170.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C4_EQIAD_IPV6 = (2620:0:861:11a::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C4_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C4_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C4_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c5-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_C5_EQIAD_IPV4 = (10.64.172.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C5_EQIAD_IPV6 = (2620:0:861:132::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C5_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C5_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C5_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c6-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_C6_EQIAD_IPV4 = (10.64.174.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C6_EQIAD_IPV6 = (2620:0:861:134::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C6_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C6_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C6_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-c7-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_C7_EQIAD_IPV4 = (10.64.176.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C7_EQIAD_IPV6 = (2620:0:861:136::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_C7_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_C7_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_C7_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_D_EQIAD_IPV4 = (10.64.53.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D_EQIAD_IPV6 = (2620:0:861:108::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d1-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_D1_EQIAD_IPV4 = (10.64.178.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D1_EQIAD_IPV6 = (2620:0:861:138::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D1_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D1_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D1_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d2-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_D2_EQIAD_IPV4 = (10.64.180.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D2_EQIAD_IPV6 = (2620:0:861:13a::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D2_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D2_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D2_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d3-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_D3_EQIAD_IPV4 = (10.64.182.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D3_EQIAD_IPV6 = (2620:0:861:13c::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D3_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D3_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D3_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d4-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_D4_EQIAD_IPV4 = (10.64.184.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D4_EQIAD_IPV6 = (2620:0:861:13e::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D4_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D4_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D4_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d6-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_D6_EQIAD_IPV4 = (10.64.186.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D6_EQIAD_IPV6 = (2620:0:861:141::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D6_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D6_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D6_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d7-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_D7_EQIAD_IPV4 = (10.64.188.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D7_EQIAD_IPV6 = (2620:0:861:143::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D7_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D7_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D7_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-d8-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_D8_EQIAD_IPV4 = (10.64.190.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D8_EQIAD_IPV6 = (2620:0:861:145::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_D8_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_D8_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_D8_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e1-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_E1_EQIAD_IPV4 = (10.64.138.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E1_EQIAD_IPV6 = (2620:0:861:100::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E1_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E1_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E1_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e2-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_E2_EQIAD_IPV4 = (10.64.139.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E2_EQIAD_IPV6 = (2620:0:861:111::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E2_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E2_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E2_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e3-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_E3_EQIAD_IPV4 = (10.64.140.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E3_EQIAD_IPV6 = (2620:0:861:112::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E3_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E3_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E3_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e5-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_E5_EQIAD_IPV4 = (10.64.153.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E5_EQIAD_IPV6 = (2620:0:861:121::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E5_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E5_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E5_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e6-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_E6_EQIAD_IPV4 = (10.64.155.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E6_EQIAD_IPV6 = (2620:0:861:123::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E6_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E6_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E6_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e7-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_E7_EQIAD_IPV4 = (10.64.157.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E7_EQIAD_IPV6 = (2620:0:861:125::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E7_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E7_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E7_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-e8-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_E8_EQIAD_IPV4 = (10.64.159.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E8_EQIAD_IPV6 = (2620:0:861:127::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_E8_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_E8_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_E8_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f1-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_F1_EQIAD_IPV4 = (10.64.142.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F1_EQIAD_IPV6 = (2620:0:861:114::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F1_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F1_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F1_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f2-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_F2_EQIAD_IPV4 = (10.64.143.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F2_EQIAD_IPV6 = (2620:0:861:115::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F2_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F2_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F2_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f3-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_F3_EQIAD_IPV4 = (10.64.144.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F3_EQIAD_IPV6 = (2620:0:861:116::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F3_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F3_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F3_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f5-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_F5_EQIAD_IPV4 = (10.64.161.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F5_EQIAD_IPV6 = (2620:0:861:129::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F5_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F5_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F5_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f6-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_F6_EQIAD_IPV4 = (10.64.163.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F6_EQIAD_IPV6 = (2620:0:861:12b::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F6_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F6_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F6_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f7-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_F7_EQIAD_IPV4 = (10.64.165.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F7_EQIAD_IPV6 = (2620:0:861:12d::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F7_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F7_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F7_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: analytics1-f8-eqiad
  -@def $EQIAD_PRIVATE_ANALYTICS1_F8_EQIAD_IPV4 = (10.64.167.0/24);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F8_EQIAD_IPV6 = (2620:0:861:12f::/64);
  -@def $EQIAD_PRIVATE_ANALYTICS1_F8_EQIAD = ($EQIAD_PRIVATE_ANALYTICS1_F8_EQIAD_IPV4 $EQIAD_PRIVATE_ANALYTICS1_F8_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: cloud-hosts1-c8-eqiad
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_C8_EQIAD_IPV4 = (10.64.151.0/24);
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_C8_EQIAD_IPV6 = (2620:0:861:11f::/64);
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_C8_EQIAD = ($EQIAD_PRIVATE_CLOUD_HOSTS1_C8_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_HOSTS1_C8_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: cloud-hosts1-d5-eqiad
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_D5_EQIAD_IPV4 = (10.64.150.0/24);
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_D5_EQIAD_IPV6 = (2620:0:861:11e::/64);
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_D5_EQIAD = ($EQIAD_PRIVATE_CLOUD_HOSTS1_D5_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_HOSTS1_D5_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: cloud-hosts1-e4-eqiad
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_E4_EQIAD_IPV4 = (10.64.148.0/24);
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_E4_EQIAD_IPV6 = (2620:0:861:11c::/64);
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_E4_EQIAD = ($EQIAD_PRIVATE_CLOUD_HOSTS1_E4_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_HOSTS1_E4_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: cloud-hosts1-eqiad
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_EQIAD_IPV4 = (10.64.20.0/24);
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_EQIAD_IPV6 = (2620:0:861:118::/64);
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_EQIAD = ($EQIAD_PRIVATE_CLOUD_HOSTS1_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_HOSTS1_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: cloud-hosts1-f4-eqiad
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_F4_EQIAD_IPV4 = (10.64.149.0/24);
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_F4_EQIAD_IPV6 = (2620:0:861:11d::/64);
  -@def $EQIAD_PRIVATE_CLOUD_HOSTS1_F4_EQIAD = ($EQIAD_PRIVATE_CLOUD_HOSTS1_F4_EQIAD_IPV4 $EQIAD_PRIVATE_CLOUD_HOSTS1_F4_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-a-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_A_EQIAD_IPV4 = (10.64.0.0/22);
  -@def $EQIAD_PRIVATE_PRIVATE1_A_EQIAD_IPV6 = (2620:0:861:101::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_A_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_A_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_A_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-aux-kubepods-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_AUX_KUBEPODS_EQIAD_IPV4 = (10.67.80.0/21);
  -@def $EQIAD_PRIVATE_PRIVATE1_AUX_KUBEPODS_EQIAD_IPV6 = (2620:0:861:305::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_AUX_KUBEPODS_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_AUX_KUBEPODS_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_AUX_KUBEPODS_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-aux-kubesvc-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_AUX_KUBESVC_EQIAD_IPV4 = (10.67.64.0/20);
  -@def $EQIAD_PRIVATE_PRIVATE1_AUX_KUBESVC_EQIAD_IPV6 = (2620:0:861:304::/116);
  -@def $EQIAD_PRIVATE_PRIVATE1_AUX_KUBESVC_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_AUX_KUBESVC_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_AUX_KUBESVC_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-b-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_B_EQIAD_IPV4 = (10.64.16.0/22);
  -@def $EQIAD_PRIVATE_PRIVATE1_B_EQIAD_IPV6 = (2620:0:861:102::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_B_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_B_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_B_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_C_EQIAD_IPV4 = (10.64.32.0/22);
  -@def $EQIAD_PRIVATE_PRIVATE1_C_EQIAD_IPV6 = (2620:0:861:103::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_C_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c2-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_C2_EQIAD_IPV4 = (10.64.133.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_C2_EQIAD_IPV6 = (2620:0:861:10c::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_C2_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C2_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C2_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c3-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_C3_EQIAD_IPV4 = (10.64.141.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_C3_EQIAD_IPV6 = (2620:0:861:113::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_C3_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C3_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C3_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c4-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_C4_EQIAD_IPV4 = (10.64.169.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_C4_EQIAD_IPV6 = (2620:0:861:119::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_C4_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C4_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C4_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c5-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_C5_EQIAD_IPV4 = (10.64.171.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_C5_EQIAD_IPV6 = (2620:0:861:131::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_C5_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C5_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C5_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c6-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_C6_EQIAD_IPV4 = (10.64.173.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_C6_EQIAD_IPV6 = (2620:0:861:133::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_C6_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C6_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C6_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-c7-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_C7_EQIAD_IPV4 = (10.64.175.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_C7_EQIAD_IPV6 = (2620:0:861:135::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_C7_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_C7_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_C7_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_D_EQIAD_IPV4 = (10.64.48.0/22);
  -@def $EQIAD_PRIVATE_PRIVATE1_D_EQIAD_IPV6 = (2620:0:861:107::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_D_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d1-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_D1_EQIAD_IPV4 = (10.64.177.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_D1_EQIAD_IPV6 = (2620:0:861:137::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_D1_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D1_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D1_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d2-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_D2_EQIAD_IPV4 = (10.64.179.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_D2_EQIAD_IPV6 = (2620:0:861:139::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_D2_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D2_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D2_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d3-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_D3_EQIAD_IPV4 = (10.64.181.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_D3_EQIAD_IPV6 = (2620:0:861:13b::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_D3_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D3_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D3_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d4-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_D4_EQIAD_IPV4 = (10.64.183.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_D4_EQIAD_IPV6 = (2620:0:861:13d::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_D4_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D4_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D4_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d6-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_D6_EQIAD_IPV4 = (10.64.185.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_D6_EQIAD_IPV6 = (2620:0:861:13f::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_D6_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D6_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D6_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d7-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_D7_EQIAD_IPV4 = (10.64.187.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_D7_EQIAD_IPV6 = (2620:0:861:142::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_D7_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D7_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D7_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-d8-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_D8_EQIAD_IPV4 = (10.64.189.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_D8_EQIAD_IPV6 = (2620:0:861:144::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_D8_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_D8_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_D8_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-dse-kubepods-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_DSE_KUBEPODS_EQIAD_IPV4 = (10.67.24.0/21);
  -@def $EQIAD_PRIVATE_PRIVATE1_DSE_KUBEPODS_EQIAD_IPV6 = (2620:0:861:302::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_DSE_KUBEPODS_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_DSE_KUBEPODS_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_DSE_KUBEPODS_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-dse-kubesvc-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_DSE_KUBESVC_EQIAD_IPV4 = (10.67.32.0/20);
  -@def $EQIAD_PRIVATE_PRIVATE1_DSE_KUBESVC_EQIAD_IPV6 = (2620:0:861:303::/116);
  -@def $EQIAD_PRIVATE_PRIVATE1_DSE_KUBESVC_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_DSE_KUBESVC_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_DSE_KUBESVC_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e1-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_E1_EQIAD_IPV4 = (10.64.130.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_E1_EQIAD_IPV6 = (2620:0:861:109::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_E1_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E1_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E1_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e2-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_E2_EQIAD_IPV4 = (10.64.131.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_E2_EQIAD_IPV6 = (2620:0:861:10a::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_E2_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E2_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E2_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e3-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_E3_EQIAD_IPV4 = (10.64.132.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_E3_EQIAD_IPV6 = (2620:0:861:10b::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_E3_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E3_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E3_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e5-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_E5_EQIAD_IPV4 = (10.64.152.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_E5_EQIAD_IPV6 = (2620:0:861:120::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_E5_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E5_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E5_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e6-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_E6_EQIAD_IPV4 = (10.64.154.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_E6_EQIAD_IPV6 = (2620:0:861:122::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_E6_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E6_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E6_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e7-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_E7_EQIAD_IPV4 = (10.64.156.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_E7_EQIAD_IPV6 = (2620:0:861:124::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_E7_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E7_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E7_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-e8-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_E8_EQIAD_IPV4 = (10.64.158.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_E8_EQIAD_IPV6 = (2620:0:861:126::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_E8_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_E8_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_E8_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f1-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_F1_EQIAD_IPV4 = (10.64.134.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_F1_EQIAD_IPV6 = (2620:0:861:10d::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_F1_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F1_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F1_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f2-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_F2_EQIAD_IPV4 = (10.64.135.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_F2_EQIAD_IPV6 = (2620:0:861:10e::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_F2_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F2_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F2_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f3-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_F3_EQIAD_IPV4 = (10.64.136.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_F3_EQIAD_IPV6 = (2620:0:861:10f::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_F3_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F3_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F3_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f5-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_F5_EQIAD_IPV4 = (10.64.160.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_F5_EQIAD_IPV6 = (2620:0:861:128::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_F5_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F5_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F5_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f6-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_F6_EQIAD_IPV4 = (10.64.162.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_F6_EQIAD_IPV6 = (2620:0:861:12a::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_F6_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F6_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F6_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f7-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_F7_EQIAD_IPV4 = (10.64.164.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_F7_EQIAD_IPV6 = (2620:0:861:12c::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_F7_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F7_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F7_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-f8-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_F8_EQIAD_IPV4 = (10.64.166.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_F8_EQIAD_IPV6 = (2620:0:861:12e::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_F8_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_F8_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_F8_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-lvs-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_LVS_EQIAD_IPV4 = (10.2.2.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_LVS_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_LVS_EQIAD_IPV4 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-mlserve-kubepods-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_EQIAD_IPV4 = (10.67.16.0/21);
  -@def $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_EQIAD_IPV6 = (2620:0:861:300::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBEPODS_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-mlserve-kubesvc-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_EQIAD_IPV4 = (10.67.0.0/20);
  -@def $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_EQIAD_IPV6 = (2620:0:861:301::/116);
  -@def $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_MLSERVE_KUBESVC_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-services-kubepods-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_EQIAD_IPV4 = (10.67.128.0/17);
  -@def $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_EQIAD_IPV6 = (2620:0:861:cabe::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBEPODS_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-services-kubesvc-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBESVC_EQIAD_IPV4 = (10.64.72.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBESVC_EQIAD_IPV6 = (2620:0:861:cabf::/116);
  -@def $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBESVC_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBESVC_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_SERVICES_KUBESVC_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-staging-kubepods-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBEPODS_EQIAD_IPV4 = (10.64.64.0/21);
  -@def $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBEPODS_EQIAD_IPV6 = (2620:0:861:babe::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBEPODS_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_STAGING_KUBEPODS_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBEPODS_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-staging-kubesvc-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBESVC_EQIAD_IPV4 = (10.64.76.0/24);
  -@def $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBESVC_EQIAD_IPV6 = (2620:0:861:babf::/116);
  -@def $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBESVC_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_STAGING_KUBESVC_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_STAGING_KUBESVC_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: private, # Network: private1-virtual-eqiad
  -@def $EQIAD_PRIVATE_PRIVATE1_VIRTUAL_EQIAD_IPV4 = (10.64.24.0/23);
  -@def $EQIAD_PRIVATE_PRIVATE1_VIRTUAL_EQIAD_IPV6 = (2620:0:861:140::/64);
  -@def $EQIAD_PRIVATE_PRIVATE1_VIRTUAL_EQIAD = ($EQIAD_PRIVATE_PRIVATE1_VIRTUAL_EQIAD_IPV4 $EQIAD_PRIVATE_PRIVATE1_VIRTUAL_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: public, # Network: public1-a-eqiad
  -@def $EQIAD_PUBLIC_PUBLIC1_A_EQIAD_IPV4 = (208.80.154.0/26);
  -@def $EQIAD_PUBLIC_PUBLIC1_A_EQIAD_IPV6 = (2620:0:861:1::/64);
  -@def $EQIAD_PUBLIC_PUBLIC1_A_EQIAD = ($EQIAD_PUBLIC_PUBLIC1_A_EQIAD_IPV4 $EQIAD_PUBLIC_PUBLIC1_A_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: public, # Network: public1-b-eqiad
  -@def $EQIAD_PUBLIC_PUBLIC1_B_EQIAD_IPV4 = (208.80.154.128/26);
  -@def $EQIAD_PUBLIC_PUBLIC1_B_EQIAD_IPV6 = (2620:0:861:2::/64);
  -@def $EQIAD_PUBLIC_PUBLIC1_B_EQIAD = ($EQIAD_PUBLIC_PUBLIC1_B_EQIAD_IPV4 $EQIAD_PUBLIC_PUBLIC1_B_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: public, # Network: public1-c-eqiad
  -@def $EQIAD_PUBLIC_PUBLIC1_C_EQIAD_IPV4 = (208.80.154.64/26);
  -@def $EQIAD_PUBLIC_PUBLIC1_C_EQIAD_IPV6 = (2620:0:861:3::/64);
  -@def $EQIAD_PUBLIC_PUBLIC1_C_EQIAD = ($EQIAD_PUBLIC_PUBLIC1_C_EQIAD_IPV4 $EQIAD_PUBLIC_PUBLIC1_C_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: public, # Network: public1-d-eqiad
  -@def $EQIAD_PUBLIC_PUBLIC1_D_EQIAD_IPV4 = (208.80.155.96/27);
  -@def $EQIAD_PUBLIC_PUBLIC1_D_EQIAD_IPV6 = (2620:0:861:4::/64);
  -@def $EQIAD_PUBLIC_PUBLIC1_D_EQIAD = ($EQIAD_PUBLIC_PUBLIC1_D_EQIAD_IPV4 $EQIAD_PUBLIC_PUBLIC1_D_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqiad, # Sphere: public, # Network: public1-lvs-eqiad
  -@def $EQIAD_PUBLIC_PUBLIC1_LVS_EQIAD_IPV4 = (208.80.154.224/27);
  -@def $EQIAD_PUBLIC_PUBLIC1_LVS_EQIAD_IPV6 = (2620:0:861:ed1a::/64);
  -@def $EQIAD_PUBLIC_PUBLIC1_LVS_EQIAD = ($EQIAD_PUBLIC_PUBLIC1_LVS_EQIAD_IPV4 $EQIAD_PUBLIC_PUBLIC1_LVS_EQIAD_IPV6 );
  -
  -# Realm: production, # Site: eqsin, # Sphere: private, # Network: private1-eqsin
  -@def $EQSIN_PRIVATE_PRIVATE1_EQSIN_IPV4 = (10.132.0.0/24);
  -@def $EQSIN_PRIVATE_PRIVATE1_EQSIN_IPV6 = (2001:df2:e500:101::/64);
  -@def $EQSIN_PRIVATE_PRIVATE1_EQSIN = ($EQSIN_PRIVATE_PRIVATE1_EQSIN_IPV4 $EQSIN_PRIVATE_PRIVATE1_EQSIN_IPV6 );
  -
  -# Realm: production, # Site: eqsin, # Sphere: private, # Network: private1-lvs-eqsin
  -@def $EQSIN_PRIVATE_PRIVATE1_LVS_EQSIN_IPV4 = (10.2.5.0/24);
  -@def $EQSIN_PRIVATE_PRIVATE1_LVS_EQSIN = ($EQSIN_PRIVATE_PRIVATE1_LVS_EQSIN_IPV4 );
  -
  -# Realm: production, # Site: eqsin, # Sphere: private, # Network: private1-virtual-eqsin
  -@def $EQSIN_PRIVATE_PRIVATE1_VIRTUAL_EQSIN_IPV4 = (10.132.2.0/24);
  -@def $EQSIN_PRIVATE_PRIVATE1_VIRTUAL_EQSIN_IPV6 = (2001:df2:e500:103::/64);
  -@def $EQSIN_PRIVATE_PRIVATE1_VIRTUAL_EQSIN = ($EQSIN_PRIVATE_PRIVATE1_VIRTUAL_EQSIN_IPV4 $EQSIN_PRIVATE_PRIVATE1_VIRTUAL_EQSIN_IPV6 );
  -
  -# Realm: production, # Site: eqsin, # Sphere: public, # Network: public1-eqsin
  -@def $EQSIN_PUBLIC_PUBLIC1_EQSIN_IPV4 = (103.102.166.0/28);
  -@def $EQSIN_PUBLIC_PUBLIC1_EQSIN_IPV6 = (2001:df2:e500:1::/64);
  -@def $EQSIN_PUBLIC_PUBLIC1_EQSIN = ($EQSIN_PUBLIC_PUBLIC1_EQSIN_IPV4 $EQSIN_PUBLIC_PUBLIC1_EQSIN_IPV6 );
  -
  -# Realm: production, # Site: eqsin, # Sphere: public, # Network: public1-lvs-eqsin
  -@def $EQSIN_PUBLIC_PUBLIC1_LVS_EQSIN_IPV4 = (103.102.166.224/27);
  -@def $EQSIN_PUBLIC_PUBLIC1_LVS_EQSIN_IPV6 = (2001:df2:e500:ed1a::/64);
  -@def $EQSIN_PUBLIC_PUBLIC1_LVS_EQSIN = ($EQSIN_PUBLIC_PUBLIC1_LVS_EQSIN_IPV4 $EQSIN_PUBLIC_PUBLIC1_LVS_EQSIN_IPV6 );
  -
  -# Realm: production, # Site: eqsin, # Sphere: public, # Network: public1-virtual-eqsin
  -@def $EQSIN_PUBLIC_PUBLIC1_VIRTUAL_EQSIN_IPV4 = (103.102.166.96/27);
  -@def $EQSIN_PUBLIC_PUBLIC1_VIRTUAL_EQSIN_IPV6 = (2001:df2:e500:3::/64);
  -@def $EQSIN_PUBLIC_PUBLIC1_VIRTUAL_EQSIN = ($EQSIN_PUBLIC_PUBLIC1_VIRTUAL_EQSIN_IPV4 $EQSIN_PUBLIC_PUBLIC1_VIRTUAL_EQSIN_IPV6 );
  -
  -# Realm: production, # Site: esams, # Sphere: private, # Network: private1-bw27-esams
  -@def $ESAMS_PRIVATE_PRIVATE1_BW27_ESAMS_IPV4 = (10.80.0.0/24);
  -@def $ESAMS_PRIVATE_PRIVATE1_BW27_ESAMS_IPV6 = (2a02:ec80:300:101::/64);
  -@def $ESAMS_PRIVATE_PRIVATE1_BW27_ESAMS = ($ESAMS_PRIVATE_PRIVATE1_BW27_ESAMS_IPV4 $ESAMS_PRIVATE_PRIVATE1_BW27_ESAMS_IPV6 );
  -
  -# Realm: production, # Site: esams, # Sphere: private, # Network: private1-by27-esams
  -@def $ESAMS_PRIVATE_PRIVATE1_BY27_ESAMS_IPV4 = (10.80.1.0/24);
  -@def $ESAMS_PRIVATE_PRIVATE1_BY27_ESAMS_IPV6 = (2a02:ec80:300:102::/64);
  -@def $ESAMS_PRIVATE_PRIVATE1_BY27_ESAMS = ($ESAMS_PRIVATE_PRIVATE1_BY27_ESAMS_IPV4 $ESAMS_PRIVATE_PRIVATE1_BY27_ESAMS_IPV6 );
  -
  -# Realm: production, # Site: esams, # Sphere: private, # Network: private1-lvs-esams
  -@def $ESAMS_PRIVATE_PRIVATE1_LVS_ESAMS_IPV4 = (10.2.3.0/24);
  -@def $ESAMS_PRIVATE_PRIVATE1_LVS_ESAMS = ($ESAMS_PRIVATE_PRIVATE1_LVS_ESAMS_IPV4 );
  -
  -# Realm: production, # Site: esams, # Sphere: private, # Network: private1-virtual-esams
  -@def $ESAMS_PRIVATE_PRIVATE1_VIRTUAL_ESAMS_IPV4 = (10.80.2.0/24);
  -@def $ESAMS_PRIVATE_PRIVATE1_VIRTUAL_ESAMS_IPV6 = (2a02:ec80:300:103::/64);
  -@def $ESAMS_PRIVATE_PRIVATE1_VIRTUAL_ESAMS = ($ESAMS_PRIVATE_PRIVATE1_VIRTUAL_ESAMS_IPV4 $ESAMS_PRIVATE_PRIVATE1_VIRTUAL_ESAMS_IPV6 );
  -
  -# Realm: production, # Site: esams, # Sphere: public, # Network: public1-bw27-esams
  -@def $ESAMS_PUBLIC_PUBLIC1_BW27_ESAMS_IPV4 = (185.15.59.0/27);
  -@def $ESAMS_PUBLIC_PUBLIC1_BW27_ESAMS_IPV6 = (2a02:ec80:300:1::/64);
  -@def $ESAMS_PUBLIC_PUBLIC1_BW27_ESAMS = ($ESAMS_PUBLIC_PUBLIC1_BW27_ESAMS_IPV4 $ESAMS_PUBLIC_PUBLIC1_BW27_ESAMS_IPV6 );
  -
  -# Realm: production, # Site: esams, # Sphere: public, # Network: public1-by27-esams
  -@def $ESAMS_PUBLIC_PUBLIC1_BY27_ESAMS_IPV4 = (185.15.59.32/27);
  -@def $ESAMS_PUBLIC_PUBLIC1_BY27_ESAMS_IPV6 = (2a02:ec80:300:2::/64);
  -@def $ESAMS_PUBLIC_PUBLIC1_BY27_ESAMS = ($ESAMS_PUBLIC_PUBLIC1_BY27_ESAMS_IPV4 $ESAMS_PUBLIC_PUBLIC1_BY27_ESAMS_IPV6 );
  -
  -# Realm: production, # Site: esams, # Sphere: public, # Network: public1-lvs-esams
  -@def $ESAMS_PUBLIC_PUBLIC1_LVS_ESAMS_IPV4 = (185.15.59.224/27);
  -@def $ESAMS_PUBLIC_PUBLIC1_LVS_ESAMS_IPV6 = (2a02:ec80:300:ed1a::/64);
  -@def $ESAMS_PUBLIC_PUBLIC1_LVS_ESAMS = ($ESAMS_PUBLIC_PUBLIC1_LVS_ESAMS_IPV4 $ESAMS_PUBLIC_PUBLIC1_LVS_ESAMS_IPV6 );
  -
  -# Realm: production, # Site: esams, # Sphere: public, # Network: public1-virtual-esams
  -@def $ESAMS_PUBLIC_PUBLIC1_VIRTUAL_ESAMS_IPV4 = (185.15.59.96/27);
  -@def $ESAMS_PUBLIC_PUBLIC1_VIRTUAL_ESAMS_IPV6 = (2a02:ec80:300:3::/64);
  -@def $ESAMS_PUBLIC_PUBLIC1_VIRTUAL_ESAMS = ($ESAMS_PUBLIC_PUBLIC1_VIRTUAL_ESAMS_IPV4 $ESAMS_PUBLIC_PUBLIC1_VIRTUAL_ESAMS_IPV6 );
  -
  -# Realm: production, # Site: magru, # Sphere: private, # Network: private1-b3-magru
  -@def $MAGRU_PRIVATE_PRIVATE1_B3_MAGRU_IPV4 = (10.140.0.0/24);
  -@def $MAGRU_PRIVATE_PRIVATE1_B3_MAGRU_IPV6 = (2a02:ec80:700:101::/64);
  -@def $MAGRU_PRIVATE_PRIVATE1_B3_MAGRU = ($MAGRU_PRIVATE_PRIVATE1_B3_MAGRU_IPV4 $MAGRU_PRIVATE_PRIVATE1_B3_MAGRU_IPV6 );
  -
  -# Realm: production, # Site: magru, # Sphere: private, # Network: private1-b4-magru
  -@def $MAGRU_PRIVATE_PRIVATE1_B4_MAGRU_IPV4 = (10.140.1.0/24);
  -@def $MAGRU_PRIVATE_PRIVATE1_B4_MAGRU_IPV6 = (2a02:ec80:700:102::/64);
  -@def $MAGRU_PRIVATE_PRIVATE1_B4_MAGRU = ($MAGRU_PRIVATE_PRIVATE1_B4_MAGRU_IPV4 $MAGRU_PRIVATE_PRIVATE1_B4_MAGRU_IPV6 );
  -
  -# Realm: production, # Site: magru, # Sphere: private, # Network: private1-lvs-magru
  -@def $MAGRU_PRIVATE_PRIVATE1_LVS_MAGRU_IPV4 = (10.2.7.0/24);
  -@def $MAGRU_PRIVATE_PRIVATE1_LVS_MAGRU = ($MAGRU_PRIVATE_PRIVATE1_LVS_MAGRU_IPV4 );
  -
  -# Realm: production, # Site: magru, # Sphere: private, # Network: private1-virtual-magru
  -@def $MAGRU_PRIVATE_PRIVATE1_VIRTUAL_MAGRU_IPV4 = (10.140.2.0/24);
  -@def $MAGRU_PRIVATE_PRIVATE1_VIRTUAL_MAGRU_IPV6 = (2a02:ec80:700:103::/64);
  -@def $MAGRU_PRIVATE_PRIVATE1_VIRTUAL_MAGRU = ($MAGRU_PRIVATE_PRIVATE1_VIRTUAL_MAGRU_IPV4 $MAGRU_PRIVATE_PRIVATE1_VIRTUAL_MAGRU_IPV6 );
  -
  -# Realm: production, # Site: magru, # Sphere: public, # Network: public1-b3-magru
  -@def $MAGRU_PUBLIC_PUBLIC1_B3_MAGRU_IPV4 = (195.200.68.0/27);
  -@def $MAGRU_PUBLIC_PUBLIC1_B3_MAGRU_IPV6 = (2a02:ec80:700:1::/64);
  -@def $MAGRU_PUBLIC_PUBLIC1_B3_MAGRU = ($MAGRU_PUBLIC_PUBLIC1_B3_MAGRU_IPV4 $MAGRU_PUBLIC_PUBLIC1_B3_MAGRU_IPV6 );
  -
  -# Realm: production, # Site: magru, # Sphere: public, # Network: public1-b4-magru
  -@def $MAGRU_PUBLIC_PUBLIC1_B4_MAGRU_IPV4 = (195.200.68.32/27);
  -@def $MAGRU_PUBLIC_PUBLIC1_B4_MAGRU_IPV6 = (2a02:ec80:700:2::/64);
  -@def $MAGRU_PUBLIC_PUBLIC1_B4_MAGRU = ($MAGRU_PUBLIC_PUBLIC1_B4_MAGRU_IPV4 $MAGRU_PUBLIC_PUBLIC1_B4_MAGRU_IPV6 );
  -
  -# Realm: production, # Site: magru, # Sphere: public, # Network: public1-lvs-magru
  -@def $MAGRU_PUBLIC_PUBLIC1_LVS_MAGRU_IPV4 = (195.200.68.224/27);
  -@def $MAGRU_PUBLIC_PUBLIC1_LVS_MAGRU_IPV6 = (2a02:ec80:700:ed1a::/64);
  -@def $MAGRU_PUBLIC_PUBLIC1_LVS_MAGRU = ($MAGRU_PUBLIC_PUBLIC1_LVS_MAGRU_IPV4 $MAGRU_PUBLIC_PUBLIC1_LVS_MAGRU_IPV6 );
  -
  -# Realm: production, # Site: magru, # Sphere: public, # Network: public1-virtual-magru
  -@def $MAGRU_PUBLIC_PUBLIC1_VIRTUAL_MAGRU_IPV4 = (195.200.68.96/27);
  -@def $MAGRU_PUBLIC_PUBLIC1_VIRTUAL_MAGRU_IPV6 = (2a02:ec80:700:3::/64);
  -@def $MAGRU_PUBLIC_PUBLIC1_VIRTUAL_MAGRU = ($MAGRU_PUBLIC_PUBLIC1_VIRTUAL_MAGRU_IPV4 $MAGRU_PUBLIC_PUBLIC1_VIRTUAL_MAGRU_IPV6 );
  -
  -# Realm: production, # Site: ulsfo, # Sphere: private, # Network: private1-22-ulsfo
  -@def $ULSFO_PRIVATE_PRIVATE1_22_ULSFO_IPV4 = (10.128.0.0/24);
  -@def $ULSFO_PRIVATE_PRIVATE1_22_ULSFO_IPV6 = (2620:0:863:101::/64);
  -@def $ULSFO_PRIVATE_PRIVATE1_22_ULSFO = ($ULSFO_PRIVATE_PRIVATE1_22_ULSFO_IPV4 $ULSFO_PRIVATE_PRIVATE1_22_ULSFO_IPV6 );
  -
  -# Realm: production, # Site: ulsfo, # Sphere: private, # Network: private1-23-ulsfo
  -@def $ULSFO_PRIVATE_PRIVATE1_23_ULSFO_IPV4 = (10.128.1.0/24);
  -@def $ULSFO_PRIVATE_PRIVATE1_23_ULSFO_IPV6 = (2620:0:863:102::/64);
  -@def $ULSFO_PRIVATE_PRIVATE1_23_ULSFO = ($ULSFO_PRIVATE_PRIVATE1_23_ULSFO_IPV4 $ULSFO_PRIVATE_PRIVATE1_23_ULSFO_IPV6 );
  -
  -# Realm: production, # Site: ulsfo, # Sphere: private, # Network: private1-lvs-ulsfo
  -@def $ULSFO_PRIVATE_PRIVATE1_LVS_ULSFO_IPV4 = (10.2.4.0/24);
  -@def $ULSFO_PRIVATE_PRIVATE1_LVS_ULSFO = ($ULSFO_PRIVATE_PRIVATE1_LVS_ULSFO_IPV4 );
  -
  -# Realm: production, # Site: ulsfo, # Sphere: private, # Network: private1-virtual-ulsfo
  -@def $ULSFO_PRIVATE_PRIVATE1_VIRTUAL_ULSFO_IPV4 = (10.128.2.0/24);
  -@def $ULSFO_PRIVATE_PRIVATE1_VIRTUAL_ULSFO_IPV6 = (2620:0:863:103::/64);
  -@def $ULSFO_PRIVATE_PRIVATE1_VIRTUAL_ULSFO = ($ULSFO_PRIVATE_PRIVATE1_VIRTUAL_ULSFO_IPV4 $ULSFO_PRIVATE_PRIVATE1_VIRTUAL_ULSFO_IPV6 );
  -
  -# Realm: production, # Site: ulsfo, # Sphere: public, # Network: public1-22-ulsfo
  -@def $ULSFO_PUBLIC_PUBLIC1_22_ULSFO_IPV4 = (198.35.26.0/27);
  -@def $ULSFO_PUBLIC_PUBLIC1_22_ULSFO_IPV6 = (2620:0:863:1::/64);
  -@def $ULSFO_PUBLIC_PUBLIC1_22_ULSFO = ($ULSFO_PUBLIC_PUBLIC1_22_ULSFO_IPV4 $ULSFO_PUBLIC_PUBLIC1_22_ULSFO_IPV6 );
  -
  -# Realm: production, # Site: ulsfo, # Sphere: public, # Network: public1-23-ulsfo
  -@def $ULSFO_PUBLIC_PUBLIC1_23_ULSFO_IPV4 = (198.35.26.32/27);
  -@def $ULSFO_PUBLIC_PUBLIC1_23_ULSFO_IPV6 = (2620:0:863:2::/64);
  -@def $ULSFO_PUBLIC_PUBLIC1_23_ULSFO = ($ULSFO_PUBLIC_PUBLIC1_23_ULSFO_IPV4 $ULSFO_PUBLIC_PUBLIC1_23_ULSFO_IPV6 );
  -
  -# Realm: production, # Site: ulsfo, # Sphere: public, # Network: public1-lvs-ulsfo
  -@def $ULSFO_PUBLIC_PUBLIC1_LVS_ULSFO_IPV4 = (198.35.26.96/27);
  -@def $ULSFO_PUBLIC_PUBLIC1_LVS_ULSFO_IPV6 = (2620:0:863:ed1a::/64);
  -@def $ULSFO_PUBLIC_PUBLIC1_LVS_ULSFO = ($ULSFO_PUBLIC_PUBLIC1_LVS_ULSFO_IPV4 $ULSFO_PUBLIC_PUBLIC1_LVS_ULSFO_IPV6 );
  -
  -# Realm: production, # Site: ulsfo, # Sphere: public, # Network: public1-virtual-ulsfo
  -@def $ULSFO_PUBLIC_PUBLIC1_VIRTUAL_ULSFO_IPV4 = (198.35.26.96/27);
  -@def $ULSFO_PUBLIC_PUBLIC1_VIRTUAL_ULSFO_IPV6 = (2620:0:863:3::/64);
  -@def $ULSFO_PUBLIC_PUBLIC1_VIRTUAL_ULSFO = ($ULSFO_PUBLIC_PUBLIC1_VIRTUAL_ULSFO_IPV4 $ULSFO_PUBLIC_PUBLIC1_VIRTUAL_ULSFO_IPV6 );
  -
  -# Realm: sandbox, # Site: codfw, # Sphere: public, # Network: sandbox1-a-codfw
  -@def $CODFW_PUBLIC_SANDBOX1_A_CODFW_IPV4 = (208.80.152.240/28);
  -@def $CODFW_PUBLIC_SANDBOX1_A_CODFW_IPV6 = (2620:0:860:201::/64);
  -@def $CODFW_PUBLIC_SANDBOX1_A_CODFW = ($CODFW_PUBLIC_SANDBOX1_A_CODFW_IPV4 $CODFW_PUBLIC_SANDBOX1_A_CODFW_IPV6 );
  -
  -# Realm: sandbox, # Site: eqiad, # Sphere: public, # Network: sandbox1-b-eqiad
  -@def $EQIAD_PUBLIC_SANDBOX1_B_EQIAD_IPV4 = (208.80.155.64/28);
  -@def $EQIAD_PUBLIC_SANDBOX1_B_EQIAD_IPV6 = (2620:0:861:202::/64);
  -@def $EQIAD_PUBLIC_SANDBOX1_B_EQIAD = ($EQIAD_PUBLIC_SANDBOX1_B_EQIAD_IPV4 $EQIAD_PUBLIC_SANDBOX1_B_EQIAD_IPV6 );
  -
  -# Realm: sandbox, # Site: eqsin, # Sphere: public, # Network: sandbox1-virtual-eqsin
  -@def $EQSIN_PUBLIC_SANDBOX1_VIRTUAL_EQSIN_IPV4 = (103.102.166.72/29);
  -@def $EQSIN_PUBLIC_SANDBOX1_VIRTUAL_EQSIN_IPV6 = (2001:df2:e500:202::/64);
  -@def $EQSIN_PUBLIC_SANDBOX1_VIRTUAL_EQSIN = ($EQSIN_PUBLIC_SANDBOX1_VIRTUAL_EQSIN_IPV4 $EQSIN_PUBLIC_SANDBOX1_VIRTUAL_EQSIN_IPV6 );
  -
  -# Realm: sandbox, # Site: esams, # Sphere: public, # Network: sandbox1-virtual-esams
  -@def $ESAMS_PUBLIC_SANDBOX1_VIRTUAL_ESAMS_IPV4 = (185.15.59.72/29);
  -@def $ESAMS_PUBLIC_SANDBOX1_VIRTUAL_ESAMS_IPV6 = (2a02:ec80:300:202::/64);
  -@def $ESAMS_PUBLIC_SANDBOX1_VIRTUAL_ESAMS = ($ESAMS_PUBLIC_SANDBOX1_VIRTUAL_ESAMS_IPV4 $ESAMS_PUBLIC_SANDBOX1_VIRTUAL_ESAMS_IPV6 );
  -
  -# Realm: sandbox, # Site: magru, # Sphere: public, # Network: sandbox1-virtual-magru
  -@def $MAGRU_PUBLIC_SANDBOX1_VIRTUAL_MAGRU_IPV4 = (195.200.68.64/29);
  -@def $MAGRU_PUBLIC_SANDBOX1_VIRTUAL_MAGRU_IPV6 = (2a02:ec80:700:201::/64);
  -@def $MAGRU_PUBLIC_SANDBOX1_VIRTUAL_MAGRU = ($MAGRU_PUBLIC_SANDBOX1_VIRTUAL_MAGRU_IPV4 $MAGRU_PUBLIC_SANDBOX1_VIRTUAL_MAGRU_IPV6 );
  -
  -# Realm: sandbox, # Site: ulsfo, # Sphere: public, # Network: sandbox1-ulsfo
  -@def $ULSFO_PUBLIC_SANDBOX1_ULSFO_IPV4 = (198.35.26.240/28);
  -@def $ULSFO_PUBLIC_SANDBOX1_ULSFO_IPV6 = (2620:0:863:201::/64);
  -@def $ULSFO_PUBLIC_SANDBOX1_ULSFO = ($ULSFO_PUBLIC_SANDBOX1_ULSFO_IPV4 $ULSFO_PUBLIC_SANDBOX1_ULSFO_IPV6 );

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
  

• File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_d2a76a31e44e204e2d4788a2698d0e6c]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_d2a76a31e44e204e2d4788a2698d0e6c].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_d2a76a31e44e204e2d4788a2698d0e6c]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="d2a76a31e44e204e2d4788a2698d0e6c",check_name="check_check_certificate_expiry_wikikube", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__wikikube
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_wikikube))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
  
  -    ensure => present
  

• File[/etc/apache2/sites-enabled]

  Parameters differences:

  --- File[/etc/apache2/sites-enabled].orig
  +++ File[/etc/apache2/sites-enabled]
  
  -    notify  => Service[apache2]
  -    ensure  => directory
  -    recurse => True
  -    purge   => True
  -    mode    => 0755
  -    require => Package[apache2]
  -    owner   => root
  -    group   => root
  

• Nrpe::Check[check_check_certificate_expiry_zuul]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_zuul].orig
  +++ Nrpe::Check[check_check_certificate_expiry_zuul]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem
  -    before    => Monitoring::Service[check_certificate_expiry_zuul]
  -    ensure    => present
  -    sudo_user => root
  

• Systemd::Unit[cfssl-ocspserve@discovery]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@discovery].orig
  +++ Systemd::Unit[cfssl-ocspserve@discovery]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@discovery
  

• Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@discovery]']
  -    refreshonly => True
  

• Sudo::User[nrpe_certificate_check_aux_front_proxy]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_aux_front_proxy].orig
  +++ Sudo::User[nrpe_certificate_check_aux_front_proxy]
  
  -    user       => nrpe_certificate_check_aux_front_proxy
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-mlserve.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-mlserve.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - mlserve
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve/ca/mlserve.pem --responses-file /etc/cfssl/ocsp/mlserve.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve' mlserve 

• File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft
  @@ -0,0 +1,189 @@
  +# Autogenerated by puppet
  +set DOMAIN_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 10.128.0.0/24,
  +             10.128.1.0/24,
  +             10.128.2.0/24,
  +             10.132.0.0/24,
  +             10.132.2.0/24,
  +             10.136.0.0/24,
  +             10.136.1.0/24,
  +             10.140.0.0/24,
  +             10.140.1.0/24,
  +             10.140.2.0/24,
  +             10.192.0.0/22,
  +             10.192.10.0/24,
  +             10.192.11.0/24,
  +             10.192.12.0/24,
  +             10.192.13.0/24,
  +             10.192.14.0/24,
  +             10.192.15.0/24,
  +             10.192.16.0/22,
  +             10.192.20.0/24,
  +             10.192.21.0/24,
  +             10.192.22.0/24,
  +             10.192.23.0/24,
  +             10.192.24.0/23,
  +             10.192.26.0/24,
  +             10.192.27.0/24,
  +             10.192.28.0/24,
  +             10.192.29.0/24,
  +             10.192.30.0/24,
  +             10.192.31.0/24,
  +             10.192.32.0/22,
  +             10.192.36.0/24,
  +             10.192.37.0/24,
  +             10.192.38.0/24,
  +             10.192.39.0/24,
  +             10.192.4.0/24,
  +             10.192.40.0/24,
  +             10.192.41.0/24,
  +             10.192.42.0/24,
  +             10.192.43.0/24,
  +             10.192.44.0/24,
  +             10.192.45.0/24,
  +             10.192.46.0/24,
  +             10.192.47.0/24,
  +             10.192.48.0/22,
  +             10.192.5.0/24,
  +             10.192.52.0/24,
  +             10.192.56.0/24,
  +             10.192.57.0/24,
  +             10.192.58.0/24,
  +             10.192.59.0/24,
  +             10.192.6.0/24,
  +             10.192.64.0/21,
  +             10.192.7.0/24,
  +             10.192.72.0/24,
  +             10.192.76.0/24,
  +             10.192.8.0/24,
  +             10.192.80.0/20,
  +             10.192.9.0/24,
  +             10.192.96.0/21,
  +             10.194.0.0/20,
  +             10.194.128.0/17,
  +             10.194.16.0/21,
  +             10.194.61.0/24,
  +             10.194.62.0/23,
  +             10.194.64.0/20,
  +             10.194.80.0/21,
  +             10.2.1.0/24,
  +             10.2.2.0/24,
  +             10.2.3.0/24,
  +             10.2.4.0/24,
  +             10.2.5.0/24,
  +             10.2.6.0/24,
  +             10.2.7.0/24,
  +             10.64.0.0/22,
  +             10.64.130.0/24,
  +             10.64.131.0/24,
  +             10.64.132.0/24,
  +             10.64.133.0/24,
  +             10.64.134.0/24,
  +             10.64.135.0/24,
  +             10.64.136.0/24,
  +             10.64.137.0/24,
  +             10.64.138.0/24,
  +             10.64.139.0/24,
  +             10.64.140.0/24,
  +             10.64.141.0/24,
  +             10.64.142.0/24,
  +             10.64.143.0/24,
  +             10.64.144.0/24,
  +             10.64.145.0/24,
  +             10.64.148.0/24,
  +             10.64.149.0/24,
  +             10.64.150.0/24,
  +             10.64.151.0/24,
  +             10.64.152.0/24,
  +             10.64.153.0/24,
  +             10.64.154.0/24,
  +             10.64.155.0/24,
  +             10.64.156.0/24,
  +             10.64.157.0/24,
  +             10.64.158.0/24,
  +             10.64.159.0/24,
  +             10.64.16.0/22,
  +             10.64.160.0/24,
  +             10.64.161.0/24,
  +             10.64.162.0/24,
  +             10.64.163.0/24,
  +             10.64.164.0/24,
  +             10.64.165.0/24,
  +             10.64.166.0/24,
  +             10.64.167.0/24,
  +             10.64.169.0/24,
  +             10.64.170.0/24,
  +             10.64.171.0/24,
  +             10.64.172.0/24,
  +             10.64.173.0/24,
  +             10.64.174.0/24,
  +             10.64.175.0/24,
  +             10.64.176.0/24,
  +             10.64.177.0/24,
  +             10.64.178.0/24,
  +             10.64.179.0/24,
  +             10.64.180.0/24,
  +             10.64.181.0/24,
  +             10.64.182.0/24,
  +             10.64.183.0/24,
  +             10.64.184.0/24,
  +             10.64.185.0/24,
  +             10.64.186.0/24,
  +             10.64.187.0/24,
  +             10.64.188.0/24,
  +             10.64.189.0/24,
  +             10.64.190.0/24,
  +             10.64.20.0/24,
  +             10.64.21.0/24,
  +             10.64.24.0/23,
  +             10.64.32.0/22,
  +             10.64.36.0/24,
  +             10.64.48.0/22,
  +             10.64.5.0/24,
  +             10.64.53.0/24,
  +             10.64.64.0/21,
  +             10.64.72.0/24,
  +             10.64.76.0/24,
  +             10.67.0.0/20,
  +             10.67.128.0/17,
  +             10.67.16.0/21,
  +             10.67.24.0/21,
  +             10.67.32.0/20,
  +             10.67.64.0/20,
  +             10.67.80.0/21,
  +             10.80.0.0/24,
  +             10.80.1.0/24,
  +             10.80.2.0/24,
  +             103.102.166.0/28,
  +             103.102.166.224/27,
  +             103.102.166.96/27,
  +             185.15.58.0/27,
  +             185.15.58.224/27,
  +             185.15.58.32/27,
  +             185.15.59.0/27,
  +             185.15.59.224/27,
  +             185.15.59.32/27,
  +             185.15.59.96/27,
  +             195.200.68.0/27,
  +             195.200.68.224/27,
  +             195.200.68.32/27,
  +             195.200.68.96/27,
  +             198.35.26.0/27,
  +             198.35.26.32/27,
  +             198.35.26.96/27,
  +             208.80.152.128/27,
  +             208.80.153.0/27,
  +             208.80.153.224/27,
  +             208.80.153.32/27,
  +             208.80.153.64/27,
  +             208.80.153.96/27,
  +             208.80.154.0/26,
  +             208.80.154.128/26,
  +             208.80.154.224/27,
  +             208.80.154.64/26,
  +             208.80.155.96/27
  +    }
  +}

• Prometheus::Node_textfile[prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_front_proxy_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem

• Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label etcd -profile ocsp /etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cassandra]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cassandra].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cassandra]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_cassandra.service
  

• Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-mlserve.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-mlserve
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-mlserve
  -
  -/var/log/cfssl-ocsprefresh-mlserve/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Nrpe::Monitor_service[check_certificate_expiry_cassandra]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_cassandra].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_cassandra]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: cassandra
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem
  -    timeout                     => 10
  

• Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]']
  -    refreshonly => True
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem

• Profile::Pki::Multirootca::Monitoring[dse_front_proxy]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[dse_front_proxy].orig
  +++ Profile::Pki::Multirootca::Monitoring[dse_front_proxy]
  
  -    intermediate => dse_front_proxy
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/lib/systemd/system/cfssl-ocspserve@zuul.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@zuul.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@zuul.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@zuul.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@zuul.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (zuul)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 10009 \
  -          -responses /etc/cfssl/ocsp/zuul.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Timer::Job[cfssl-gc-expired-certs]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-gc-expired-certs].orig
  +++ Systemd::Timer::Job[cfssl-gc-expired-certs]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': 'hourly'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Delete expired Certificates from the cfssl DB
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-certs clean
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_etcd]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem

• Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.timer (prometheus-node-textfile-check-nft.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.timer (prometheus-node-textfile-check-nft.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.timer (prometheus-node-textfile-check-nft.timer)]
  
  +    command     => /bin/systemctl daemon-reload
  +    before      => ['Service[prometheus-node-textfile-check-nft.timer]']
  +    refreshonly => True
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
  

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
  
  -    ensure => present
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/sudoers.d/nrpe_certificate_check_mlserve]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_mlserve].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_mlserve]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
  

• Systemd::Service[cfssl-ocspserve@aux_front_proxy]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@aux_front_proxy].orig
  +++ Systemd::Service[cfssl-ocspserve@aux_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Logrotate::Conf[cfssl-ocsprefresh-aux]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-aux].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-aux]
  
  -    ensure => present
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-dse-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Systemd::Unit[cfssl-ocsprefresh-dse.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-dse.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-dse.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-dse.timer
  

• Nftables::Set[AUX_KUBEPODS_NETWORKS]

  Parameters differences:

  --- Nftables::Set[AUX_KUBEPODS_NETWORKS].orig
  +++ Nftables::Set[AUX_KUBEPODS_NETWORKS]
  
  +    hosts  => ['10.67.80.0/21', '2620:0:861:305::/64', '10.194.80.0/21', '2620:0:860:305::/64']
  +    ensure => present
  

• Logrotate::Conf[cfssl-ocsprefresh-aux_front_proxy]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-aux_front_proxy].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-aux_front_proxy]
  
  -    ensure => present
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-discovery" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-discovery/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft
  @@ -0,0 +1,9 @@
  +# Autogenerated by puppet
  +set STAGING_KUBEPODS_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2620:0:861:babe::/64,
  +             2620:0:860:babe::/64
  +    }
  +}

• File[/usr/local/bin/prometheus-check-etcd-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-etcd-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-etcd-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cassandra]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cassandra].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cassandra]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: cassandra
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_cassandra!10
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_front_proxy command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "9d6dd05c8e5e1bb294462d932b24bd1a" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_front_proxy"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Sudo::User[nrpe_certificate_check_cassandra]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_cassandra].orig
  +++ Sudo::User[nrpe_certificate_check_cassandra]
  
  -    user       => nrpe_certificate_check_cassandra
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• Profile::Pki::Multirootca::Monitoring[wikikube_staging_front_proxy]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[wikikube_staging_front_proxy].orig
  +++ Profile::Pki::Multirootca::Monitoring[wikikube_staging_front_proxy]
  
  -    intermediate => wikikube_staging_front_proxy
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
  

• File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft
  @@ -0,0 +1,99 @@
  +# Autogenerated by puppet
  +set MW_APPSERVER_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2620:0:861:101::/64,
  +             2620:0:861:102::/64,
  +             2620:0:861:103::/64,
  +             2620:0:861:107::/64,
  +             2620:0:861:109::/64,
  +             2620:0:861:10a::/64,
  +             2620:0:861:10b::/64,
  +             2620:0:861:10c::/64,
  +             2620:0:861:10d::/64,
  +             2620:0:861:10e::/64,
  +             2620:0:861:10f::/64,
  +             2620:0:861:113::/64,
  +             2620:0:861:119::/64,
  +             2620:0:861:120::/64,
  +             2620:0:861:122::/64,
  +             2620:0:861:124::/64,
  +             2620:0:861:126::/64,
  +             2620:0:861:128::/64,
  +             2620:0:861:12a::/64,
  +             2620:0:861:12c::/64,
  +             2620:0:861:12e::/64,
  +             2620:0:861:131::/64,
  +             2620:0:861:133::/64,
  +             2620:0:861:135::/64,
  +             2620:0:861:137::/64,
  +             2620:0:861:139::/64,
  +             2620:0:861:13b::/64,
  +             2620:0:861:13d::/64,
  +             2620:0:861:13f::/64,
  +             2620:0:861:142::/64,
  +             2620:0:861:144::/64,
  +             2620:0:860:100::/64,
  +             2620:0:860:101::/64,
  +             2620:0:860:102::/64,
  +             2620:0:860:103::/64,
  +             2620:0:860:104::/64,
  +             2620:0:860:105::/64,
  +             2620:0:860:106::/64,
  +             2620:0:860:107::/64,
  +             2620:0:860:108::/64,
  +             2620:0:860:109::/64,
  +             2620:0:860:10a::/64,
  +             2620:0:860:10b::/64,
  +             2620:0:860:10c::/64,
  +             2620:0:860:10d::/64,
  +             2620:0:860:10e::/64,
  +             2620:0:860:10f::/64,
  +             2620:0:860:110::/64,
  +             2620:0:860:111::/64,
  +             2620:0:860:112::/64,
  +             2620:0:860:113::/64,
  +             2620:0:860:114::/64,
  +             2620:0:860:115::/64,
  +             2620:0:860:116::/64,
  +             2620:0:860:119::/64,
  +             2620:0:860:11a::/64,
  +             2620:0:860:11b::/64,
  +             2620:0:860:11c::/64,
  +             2620:0:860:11d::/64,
  +             2620:0:860:11e::/64,
  +             2620:0:860:11f::/64,
  +             2620:0:860:120::/64,
  +             2620:0:860:121::/64,
  +             2620:0:860:122::/64,
  +             2620:0:860:123::/64,
  +             2620:0:860:124::/64,
  +             2620:0:860:125::/64,
  +             2620:0:860:126::/64,
  +             2620:0:860:127::/64,
  +             2620:0:860:12b::/64,
  +             2620:0:860:12c::/64,
  +             2620:0:860:12d::/64,
  +             2620:0:860:12e::/64,
  +             2620:0:860:300::/64,
  +             2620:0:860:302::/64,
  +             2620:0:860:305::/64,
  +             2620:0:860:308::/64,
  +             2620:0:860:babe::/64,
  +             2620:0:860:cabe::/64,
  +             2620:0:861:300::/64,
  +             2620:0:861:302::/64,
  +             2620:0:861:305::/64,
  +             2620:0:861:babe::/64,
  +             2620:0:861:cabe::/64,
  +             2620:0:861:1::/64,
  +             2620:0:861:2::/64,
  +             2620:0:861:3::/64,
  +             2620:0:861:4::/64,
  +             2620:0:860:1::/64,
  +             2620:0:860:2::/64,
  +             2620:0:860:3::/64,
  +             2620:0:860:4::/64
  +    }
  +}

• Rsyslog::Conf[cfssl-ocsprefresh-debmonitor]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-debmonitor].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-debmonitor]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-debmonitor]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Service[nrpe2nodexp-check_certificate_expiry_etcd.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_etcd.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_etcd.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]']
  

• File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft].orig
  +++ File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft.orig
  +++ /etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft
  @@ -0,0 +1,15 @@
  +# Autogenerated by puppet
  +set KAFKA_BROKERS_LOGGING_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:102:10:64:16:205,
  +             2620:0:861:10c:10:64:133:11,
  +             2620:0:861:13d:10:64:183:12,
  +             2620:0:861:10a:10:64:131:13,
  +             2620:0:861:10e:10:64:135:13,
  +             2620:0:860:113:10:192:23:29,
  +             2620:0:860:10c:10:192:11:28,
  +             2620:0:860:105:10:192:26:22,
  +             2620:0:860:10c:10:192:11:27,
  +             2620:0:860:11e:10:192:39:25
  +    }
  +}

• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-mlserve_staging.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-mlserve_staging.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Profile::Pki::Multirootca::Monitoring[wikikube_front_proxy]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[wikikube_front_proxy].orig
  +++ Profile::Pki::Multirootca::Monitoring[wikikube_front_proxy]
  
  -    intermediate => wikikube_front_proxy
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
  

• Prometheus::Node_textfile[prometheus-check-etcd-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-etcd-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-etcd-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-etcd-certificate-expiry --cert-path /etc/cfssl/signers/etcd/ca/etcd.pem --outfile /var/lib/prometheus/node.d/etcd_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Rsyslog::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-cloud_wmnet_ca].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca]
  -    ensure   => present
  -    mode     => 0444
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/nagios/nrpe.d/check_ferm_active.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_ferm_active.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_ferm_active.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_ferm_active.cfg.orig
  +++ /etc/nagios/nrpe.d/check_ferm_active.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_ferm_active]=/usr/bin/sudo /usr/local/lib/nagios/plugins/check_ferm

• File[/etc/cfssl/signers/wikikube_staging_front_proxy]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_staging_front_proxy].orig
  +++ File[/etc/cfssl/signers/wikikube_staging_front_proxy]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Systemd::Service[cfssl-ocsprefresh-etcd]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-etcd].orig
  +++ Systemd::Service[cfssl-ocsprefresh-etcd]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-etcd.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Exec[Generate initial CRL for puppet_rsa]

  Parameters differences:

  --- Exec[Generate initial CRL for puppet_rsa].orig
  +++ Exec[Generate initial CRL for puppet_rsa]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/puppet_rsa
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/puppet_rsa
  

• File[/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Rsyslog::Conf[cfssl-ocsprefresh-mlserve_front_proxy]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-mlserve_front_proxy].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-mlserve_front_proxy]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/cfssl/signers/wikikube_front_proxy]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_front_proxy].orig
  +++ File[/etc/cfssl/signers/wikikube_front_proxy]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Service[cfssl-ocsprefresh-discovery2026.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-discovery2026.timer].orig
  +++ Service[cfssl-ocsprefresh-discovery2026.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/var/log/cfssl-ocsprefresh-discovery]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-discovery].orig
  +++ File[/var/log/cfssl-ocsprefresh-discovery]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Cfssl::Cert[OCSP_syslog_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_syslog_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_syslog_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => syslog
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@syslog]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-syslog]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• File[/etc/sudoers.d/nrpe_certificate_check_kafka]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_kafka].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_kafka]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/signers/network_devices]

  Parameters differences:

  --- File[/etc/cfssl/signers/network_devices].orig
  +++ File[/etc/cfssl/signers/network_devices]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-wikikube_front_proxy.service
  

• Nrpe::Check[check_check_certificate_expiry_puppet_rsa]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_puppet_rsa].orig
  +++ Nrpe::Check[check_check_certificate_expiry_puppet_rsa]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
  -    before    => Monitoring::Service[check_certificate_expiry_puppet_rsa]
  -    ensure    => present
  -    sudo_user => root
  

• Nftables::Set[ZOOKEEPER_HOSTS_MAIN]

  Parameters differences:

  --- Nftables::Set[ZOOKEEPER_HOSTS_MAIN].orig
  +++ Nftables::Set[ZOOKEEPER_HOSTS_MAIN]
  
  +    hosts  => ['10.64.0.207', '2620:0:861:101:10:64:0:207', '10.64.16.110', '2620:0:861:102:10:64:16:110', '10.64.48.154', '2620:0:861:107:10:64:48:154', '10.192.16.45', '2620:0:860:102:10:192:16:45', '10.192.32.52', '2620:0:860:103:10:192:32:52', '10.192.48.59', '2620:0:860:104:10:192:48:59']
  +    ensure => present
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• Prometheus::Blackbox::Check::Http[PKI_mlserve_staging_front_proxy]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_mlserve_staging_front_proxy].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_mlserve_staging_front_proxy]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"mlserve_staging_front_proxy"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft
  @@ -0,0 +1,9 @@
  +# Autogenerated by puppet
  +set AUX_KUBEPODS_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2620:0:861:305::/64,
  +             2620:0:860:305::/64
  +    }
  +}

• File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Nrpe::Monitor_service[check_certificate_expiry_dse_front_proxy]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_dse_front_proxy].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_dse_front_proxy]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: dse_front_proxy
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
  -    timeout                     => 10
  

• Systemd::Timer::Job[cfssl-ocsprefresh-aux]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-aux].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-aux]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - aux
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/aux/ca/aux.pem --responses-file /etc/cfssl/ocsp/aux.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@aux' aux 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Unit[cfssl-ocsprefresh-mlserve.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-mlserve.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-mlserve.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-mlserve.timer
  

• Systemd::Timer[cfssl-ocsprefresh-mlserve_staging_front_proxy]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-mlserve_staging_front_proxy]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-mlserve_staging_front_proxy.service
  

• Nftables::Set[LINK_LOCAL]

  Parameters differences:

  --- Nftables::Set[LINK_LOCAL].orig
  +++ Nftables::Set[LINK_LOCAL]
  
  +    hosts  => ['169.254.0.0/16', 'fe80::/10']
  +    ensure => present
  

• File[/etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp].orig
  +++ File[/etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Cfssl::Signer[mlserve_front_proxy]

  Parameters differences:

  --- Cfssl::Signer[mlserve_front_proxy].orig
  +++ Cfssl::Signer[mlserve_front_proxy]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDtzCCAxigAwIBAgIUIw4+rszPiPmnvGoMBfrD29oWNKcwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
  gTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
  aW9uczEcMBoGA1UEAwwTbWxzZXJ2ZV9mcm9udF9wcm94eTCBmzAQBgcqhkjOPQIB
  BgUrgQQAIwOBhgAEATdxtFPSx+kYYz4a6PyKfBi000SHiFxHSQqS71Bs13jbumD2
  h6uPdTyD3dT79AdxQVzoer7inVQZM1vz5ZioLN0mAVH9OdSm8NLPpy9CAjT/2puk
  6PZWtowGmcoOkXeZeZDIUOYam0f4udjmot9TDQPF07pSqABlhz1ejSC3AKOJDym+
  o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYD
  VR0OBBYEFDoU1EzaIZxR2ktTe35M8ILp07mdMB8GA1UdIwQYMBaAFDutonHmNL0b
  /IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDov
  L3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
  dF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5l
  dC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwA
  MIGIAkIBsRpAWU0SxP3lwtUrriS8Dtal1vh2vfBMUzvx8hzjHGSYCg3xlG2cfnXN
  lFIhsQaWUmiJFZg8m+rCdYNkUMsdpeACQgCCHUls+Tf5Kcc756qs2iC2JSf2yd2U
  EM7VAJqZRVG9HrCUnzDLJT7bIQswE6i/O1zNhKjYV9xgd6LW+XCF0cVB7A==
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => nosecret
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/mlserve_front_proxy
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/mlserve_front_proxy
  -    ca_key_file      => /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages   => ['signing', 'key encipherment', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• File[/etc/cfssl/signers/dse/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/dse/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/dse/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/dse/cfssl.conf.orig
  +++ /etc/cfssl/signers/dse/cfssl.conf
  @@ -1,81 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "signing",
  -        "key encipherment",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/dse",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/dse"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "service-account-management": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment"
  -        ]
  -      },
  -      "prometheus": {
  -        "auth_key": "default_auth",
  -        "expiry": "8760h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "client auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Httpd::Site[dummy]

  Parameters differences:

  --- Httpd::Site[dummy].orig
  +++ Httpd::Site[dummy]
  
  -    priority => 0
  -    source   => puppet:///modules/httpd/dummy.conf
  -    ensure   => present
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery2026]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery2026].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery2026]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_discovery2026 command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "bf2e3510cb63e5f05f545e816bab4edf" --timeout 10 --check-command "check_check_certificate_expiry_discovery2026"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_discovery2026
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - dse_front_proxy
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --responses-file /etc/cfssl/ocsp/dse_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@dse_front_proxy' dse_front_proxy 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Cfssl::Signer[syslog]

  Parameters differences:

  --- Cfssl::Signer[syslog].orig
  +++ Cfssl::Signer[syslog]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/syslog/ca/syslog.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDqTCCAwqgAwIBAgIUI5/ixOCtnw8ZXV6xWw6RVC/D6rwwCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjMwOTI4MTAzNzAwWhcNMjgwOTI2MTAzNzAwWjB0
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMQ8wDQYDVQQDEwZzeXNsb2cwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABL
  CaZwsDnVcBhApShaeA1j8/9w4S2re0Zmjx7GTeBXiJcKF0dAhgAQRCMrGtWEimmQ
  W94s5015H1MknO61lLOY+wDAFYkq98rZF2aRRILm1w/5iRkqTDiBECBVE15jrPzD
  q4zZCQ5V5ellWhzfGfPMxFOogIm1sqZsqZvB7zZaCSOrbaOCAQwwggEIMA4GA1Ud
  DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRvwMc33QVQ
  qaT1dZmUUtkBeYiyzjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBW
  BggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5
  LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMw
  QTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRp
  YV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAUtK7APyQamN
  8DYOBCd1wJQ1DbYlzcQOcupJns2RKKcxFp1evo2GQjDA15TN1OXtA+pvK/liCAEh
  p828+NcE6fPMAkIBN/Yjhvy0lrtVzshqckUEciShFhbDU0QZOHuzIXCVjdskzQfu
  as4ZMO15kIv0MZUJ6V9aKEE6nqzi9QXifjuoY54=
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => nosecret
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/syslog
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/syslog
  -    ca_key_file      => /etc/cfssl/signers/syslog/ca/syslog-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages   => ['digital signature', 'key encipherment', 'server auth', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft
  @@ -0,0 +1,12 @@
  +# Autogenerated by puppet
  +set CLOUD_PRIVATE_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2a02:ec80:a000:201::/64,
  +             2a02:ec80:a000:202::/64,
  +             2a02:ec80:a000:203::/64,
  +             2a02:ec80:a000:204::/64,
  +             2a02:ec80:a100:205::/64
  +    }
  +}

• File[/etc/ferm/conf.d/10_ssh_from_bastion]

  Parameters differences:

  --- File[/etc/ferm/conf.d/10_ssh_from_bastion].orig
  +++ File[/etc/ferm/conf.d/10_ssh_from_bastion]
  
  -    notify  => Service[ferm]
  -    require => File[/etc/ferm/conf.d]
  -    ensure  => present
  -    owner   => root
  -    tag     => ferm
  -    mode    => 0400
  -    group   => root
  

  Content differences:

  --- /etc/ferm/conf.d/10_ssh_from_bastion.orig
  +++ /etc/ferm/conf.d/10_ssh_from_bastion
  @@ -1,6 +0,0 @@
  -# Autogenerated by puppet. DO NOT EDIT BY HAND!
  -#
  -# 
  -&R_SERVICE(tcp, 22, (103.102.166.103 185.15.58.6 185.15.59.99 195.200.68.99 198.35.26.104 2001:df2:e500:3:103:102:166:103 208.80.153.110 208.80.154.7 2620:0:860:4:208:80:153:110 2620:0:861:1:208:80:154:7 2620:0:863:3:198:35:26:104 2a02:ec80:300:3:185:15:59:99 2a02:ec80:600:1:185:15:58:6 2a02:ec80:700:3:195:200:68:99));
  -
  -

• Systemd::Unit[wmf_auto_restart_apache2.service]

  Parameters differences:

  --- Systemd::Unit[wmf_auto_restart_apache2.service].orig
  +++ Systemd::Unit[wmf_auto_restart_apache2.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => wmf_auto_restart_apache2.service
  

• File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
  +++ File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/etc/cfssl/signers/dse_front_proxy/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/dse_front_proxy/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/dse_front_proxy/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/dse_front_proxy/cfssl.conf.orig
  +++ /etc/cfssl/signers/dse_front_proxy/cfssl.conf
  @@ -1,64 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "signing",
  -        "key encipherment",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/dse_front_proxy",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/dse_front_proxy"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Nrpe::Monitor_service[check_cfssl-multirootca_status]

  Parameters differences:

  --- Nrpe::Monitor_service[check_cfssl-multirootca_status].orig
  +++ Nrpe::Monitor_service[check_cfssl-multirootca_status]
  
  -    migration_task              => T350694
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 10
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI
  -    description                 => Check unit status of cfssl-multirootca
  -    enable_icinga_check         => True
  -    alertmanager_team           => observability
  -    retries                     => 2
  -    critical                    => True
  -    enable_nrpe2nodexp          => False
  -    nrpe_command                => /usr/local/lib/nagios/plugins/check_systemd_unit_status cfssl-multirootca
  -    timeout                     => 10
  -    nrpe2nodexp_parse_perf_data => False
  

• Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem']
  -    tag        => nrpe::check
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/var/log/cfssl-ocsprefresh-aux]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-aux].orig
  +++ File[/var/log/cfssl-ocsprefresh-aux]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/var/log/cfssl-ocsprefresh-debmonitor]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-debmonitor].orig
  +++ File[/var/log/cfssl-ocsprefresh-debmonitor]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Service[cfssl-ocspserve@debmonitor]

  Parameters differences:

  --- Service[cfssl-ocspserve@debmonitor].orig
  +++ Service[cfssl-ocspserve@debmonitor]
  
  -    ensure => running
  -    enable => True
  

• Systemd::Unit[cfssl-ocsprefresh-aux.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-aux.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-aux.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-aux.service
  

• File[/etc/systemd/system/ferm.service.d/ferm-service-status-restart.conf]

  Parameters differences:

  --- File[/etc/systemd/system/ferm.service.d/ferm-service-status-restart.conf].orig
  +++ File[/etc/systemd/system/ferm.service.d/ferm-service-status-restart.conf]
  
  -    notify => Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-status-restart)]
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/ferm/ferm_systemd_override
  -    mode   => 0444
  -    group  => root
  

• Exec[Generate initial CRL for kafka]

  Parameters differences:

  --- Exec[Generate initial CRL for kafka].orig
  +++ Exec[Generate initial CRL for kafka]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/kafka/ca/kafka.pem /etc/cfssl/signers/kafka/ca/kafka-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/kafka
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/kafka
  

• File[/etc/cfssl/signers/mlserve]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve].orig
  +++ File[/etc/cfssl/signers/mlserve]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
  

• Systemd::Timer::Job[wmf_auto_restart_ulogd2]

  Parameters differences:

  --- Systemd::Timer::Job[wmf_auto_restart_ulogd2].orig
  +++ Systemd::Timer::Job[wmf_auto_restart_ulogd2]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 5:37:00'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Auto restart job: ulogd2
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/wmf-auto-restart -s ulogd2
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    require                   => File[/usr/local/sbin/wmf-auto-restart]
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-mlserve_staging" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-mlserve_staging/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_etcd]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_etcd].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_etcd]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_etcd.service
  

• File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_network_devices]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_network_devices].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_network_devices]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: network_devices
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_network_devices!10
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-wikikube" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-wikikube/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/etc/nftables/sets/LINK_LOCAL_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/LINK_LOCAL_ipv6.nft].orig
  +++ File[/etc/nftables/sets/LINK_LOCAL_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/LINK_LOCAL_ipv6.nft.orig
  +++ /etc/nftables/sets/LINK_LOCAL_ipv6.nft
  @@ -0,0 +1,8 @@
  +# Autogenerated by puppet
  +set LINK_LOCAL_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { fe80::/10
  +    }
  +}

• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem

• Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-dse_front_proxy.service
  

• Rsyslog::Conf[wmf_auto_restart_apache-htcacheclean]

  Parameters differences:

  --- Rsyslog::Conf[wmf_auto_restart_apache-htcacheclean].orig
  +++ Rsyslog::Conf[wmf_auto_restart_apache-htcacheclean]
  
  -    priority => 40
  -    require  => File[/var/log/wmf_auto_restart_apache-htcacheclean]
  -    ensure   => absent
  -    mode     => 0444
  

• Systemd::Unit[wmf_auto_restart_apache-htcacheclean.timer]

  Parameters differences:

  --- Systemd::Unit[wmf_auto_restart_apache-htcacheclean.timer].orig
  +++ Systemd::Unit[wmf_auto_restart_apache-htcacheclean.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => wmf_auto_restart_apache-htcacheclean.timer
  

• File[/etc/sudoers.d/nrpe_certificate_check_wikikube_front_proxy]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_wikikube_front_proxy].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_wikikube_front_proxy]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
  
  -    ensure => present
  

• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-wikikube_staging_front_proxy.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-wikikube_staging_front_proxy.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/usr/local/bin/prometheus-check-kafka-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-kafka-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-kafka-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• File[/etc/ulogd.conf]

  Parameters differences:

  --- File[/etc/ulogd.conf].orig
  +++ File[/etc/ulogd.conf]
  
  -    notify => Service[ulogd2]
  -    ensure => file
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/ulogd.conf.orig
  +++ /etc/ulogd.conf
  @@ -1,71 +0,0 @@
  -# MANAGED BY PUPPET
  -[global]
  -logfile=syslog
  -loglevel=3
  -
  -
  -stack=log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,syslog1:SYSLOG
  -
  -
  -
  -
  -[ct1]
  -
  -[ct2]
  -hash_enable=0
  -
  -[mark]
  -
  -[log1]
  -group=0
  -
  -[log2]
  -group=1
  -
  -[log3]
  -group=2
  -
  -[logemu1]
  -sync=1
  -file=/var/log/ulog/syslogemu.log
  -
  -[emunfct1]
  -sync=1
  -file=/var/log/ulog/syslogemu_nfct.log
  -
  -[json1]
  -sync=1
  -file=/var/log/ulog/ulogd.json
  -
  -[jsonnfct1]
  -sync=1
  -file=/var/log/ulog/ulogd_nfct.json
  -
  -
  -[oprint1]
  -sync=1
  -file=/var/log/ulog/oprint.log
  -
  -[gprint1]
  -sync=1
  -file=/var/log/ulog/gprint.log
  -
  -[json1]
  -sync=1
  -file=/var/log/ulog/ulogd.json
  -
  -[xml1]
  -sync=1
  -file=/var/log/ulog/
  -
  -[pcap1]
  -sync=1
  -file=
  -
  -[nacct1]
  -sync=1
  -file=
  -
  -[syslog1]
  -facility=LOG_LOCAL7
  -level=LOG_INFO

• Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-wikikube_staging" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-wikikube_staging/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Prometheus::Alert::Rule[check_check_certificate_expiry_discovery2026_bf2e3510cb63e5f05f545e816bab4edf]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_discovery2026_bf2e3510cb63e5f05f545e816bab4edf].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_discovery2026_bf2e3510cb63e5f05f545e816bab4edf]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: discovery2026
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="bf2e3510cb63e5f05f545e816bab4edf",check_name="check_check_certificate_expiry_discovery2026", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__discovery2026
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: discovery2026
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_discovery2026))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Class[Ferm]

  Parameters differences:

  --- Class[Ferm].orig
  +++ Class[Ferm]
  
  @@
  -    ensure => present
  +    ensure => absent
  

• Systemd::Service[cfssl-ocsprefresh-aux_front_proxy]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-aux_front_proxy].orig
  +++ Systemd::Service[cfssl-ocsprefresh-aux_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_kafka.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_kafka.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_kafka.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• File[/etc/cfssl/multiroot.conf]

  Parameters differences:

  --- File[/etc/cfssl/multiroot.conf].orig
  +++ File[/etc/cfssl/multiroot.conf]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => present
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/multiroot.conf.orig
  +++ /etc/cfssl/multiroot.conf
  @@ -1,138 +0,0 @@
  -[debmonitor]
  -private = file:///etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem
  -certificate = /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
  -config = /etc/cfssl/signers/debmonitor/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[discovery]
  -private = file:///etc/cfssl/signers/discovery/ca/discovery-key.pem
  -certificate = /etc/cfssl/signers/discovery/ca/discovery.pem
  -config = /etc/cfssl/signers/discovery/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[kafka]
  -private = file:///etc/cfssl/signers/kafka/ca/kafka-key.pem
  -certificate = /etc/cfssl/signers/kafka/ca/kafka.pem
  -config = /etc/cfssl/signers/kafka/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[cloud_wmnet_ca]
  -private = file:///etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem
  -certificate = /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
  -config = /etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[etcd]
  -private = file:///etc/cfssl/signers/etcd/ca/etcd-key.pem
  -certificate = /etc/cfssl/signers/etcd/ca/etcd.pem
  -config = /etc/cfssl/signers/etcd/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[cassandra]
  -private = file:///etc/cfssl/signers/cassandra/ca/cassandra-key.pem
  -certificate = /etc/cfssl/signers/cassandra/ca/cassandra.pem
  -config = /etc/cfssl/signers/cassandra/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[syslog]
  -private = file:///etc/cfssl/signers/syslog/ca/syslog-key.pem
  -certificate = /etc/cfssl/signers/syslog/ca/syslog.pem
  -config = /etc/cfssl/signers/syslog/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[puppet_rsa]
  -private = file:///etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem
  -certificate = /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
  -config = /etc/cfssl/signers/puppet_rsa/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[zuul]
  -private = file:///etc/cfssl/signers/zuul/ca/zuul-key.pem
  -certificate = /etc/cfssl/signers/zuul/ca/zuul.pem
  -config = /etc/cfssl/signers/zuul/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[discovery2026]
  -private = file:///etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem
  -certificate = /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
  -config = /etc/cfssl/signers/discovery2026/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[wikikube]
  -private = file:///etc/cfssl/signers/wikikube/ca/wikikube-key.pem
  -certificate = /etc/cfssl/signers/wikikube/ca/wikikube.pem
  -config = /etc/cfssl/signers/wikikube/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[wikikube_front_proxy]
  -private = file:///etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem
  -certificate = /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
  -config = /etc/cfssl/signers/wikikube_front_proxy/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[wikikube_staging]
  -private = file:///etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem
  -certificate = /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
  -config = /etc/cfssl/signers/wikikube_staging/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[wikikube_staging_front_proxy]
  -private = file:///etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem
  -certificate = /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
  -config = /etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[mlserve]
  -private = file:///etc/cfssl/signers/mlserve/ca/mlserve-key.pem
  -certificate = /etc/cfssl/signers/mlserve/ca/mlserve.pem
  -config = /etc/cfssl/signers/mlserve/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[mlserve_front_proxy]
  -private = file:///etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem
  -certificate = /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
  -config = /etc/cfssl/signers/mlserve_front_proxy/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[mlserve_staging]
  -private = file:///etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem
  -certificate = /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
  -config = /etc/cfssl/signers/mlserve_staging/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[mlserve_staging_front_proxy]
  -private = file:///etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem
  -certificate = /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
  -config = /etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[aux]
  -private = file:///etc/cfssl/signers/aux/ca/aux-key.pem
  -certificate = /etc/cfssl/signers/aux/ca/aux.pem
  -config = /etc/cfssl/signers/aux/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[aux_front_proxy]
  -private = file:///etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem
  -certificate = /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
  -config = /etc/cfssl/signers/aux_front_proxy/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[dse]
  -private = file:///etc/cfssl/signers/dse/ca/dse-key.pem
  -certificate = /etc/cfssl/signers/dse/ca/dse.pem
  -config = /etc/cfssl/signers/dse/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[dse_front_proxy]
  -private = file:///etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem
  -certificate = /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
  -config = /etc/cfssl/signers/dse_front_proxy/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -
  -[network_devices]
  -private = file:///etc/cfssl/signers/network_devices/ca/network_devices-key.pem
  -certificate = /etc/cfssl/signers/network_devices/ca/network_devices.pem
  -config = /etc/cfssl/signers/network_devices/cfssl.conf
  -dbconfig = /etc/cfssl/db.conf
  -

• File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft.orig
  +++ /etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft
  @@ -0,0 +1,9 @@
  +# Autogenerated by puppet
  +set PROMETHEUS_HOSTS_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:101:10:64:0:82,
  +             2620:0:861:102:10:64:16:62,
  +             2620:0:861:107:10:64:48:171,
  +             2620:0:861:103:10:64:32:85
  +    }
  +}

• Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]']
  

• File[/etc/cfssl/ocsp/puppet_rsa.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/puppet_rsa.ocsp].orig
  +++ File[/etc/cfssl/ocsp/puppet_rsa.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• File[/var/log/cfssl-gc-expired-certs]

  Parameters differences:

  --- File[/var/log/cfssl-gc-expired-certs].orig
  +++ File[/var/log/cfssl-gc-expired-certs]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_zuul.service
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]']
  -    refreshonly => True
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer
  

• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Logrotate::Conf[cfssl-ocsprefresh-syslog]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-syslog].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-syslog]
  
  -    ensure => present
  

• Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Nrpe::Check[check_check_certificate_expiry_wikikube_front_proxy]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_wikikube_front_proxy].orig
  +++ Nrpe::Check[check_check_certificate_expiry_wikikube_front_proxy]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
  -    before    => Monitoring::Service[check_certificate_expiry_wikikube_front_proxy]
  -    ensure    => present
  -    sudo_user => root
  

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
  
  -    ensure => present
  

• Exec[renew certificate - OCSP_mlserve_staging_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_mlserve_staging_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_mlserve_staging_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem -checkend 952200
  

• File[/srv/cfssl/bundles/mlserve_front_proxy.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/mlserve_front_proxy.pem].orig
  +++ File[/srv/cfssl/bundles/mlserve_front_proxy.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/mlserve_front_proxy.pem.orig
  +++ /srv/cfssl/bundles/mlserve_front_proxy.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDtzCCAxigAwIBAgIUIw4+rszPiPmnvGoMBfrD29oWNKcwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
  -gTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  -GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
  -aW9uczEcMBoGA1UEAwwTbWxzZXJ2ZV9mcm9udF9wcm94eTCBmzAQBgcqhkjOPQIB
  -BgUrgQQAIwOBhgAEATdxtFPSx+kYYz4a6PyKfBi000SHiFxHSQqS71Bs13jbumD2
  -h6uPdTyD3dT79AdxQVzoer7inVQZM1vz5ZioLN0mAVH9OdSm8NLPpy9CAjT/2puk
  -6PZWtowGmcoOkXeZeZDIUOYam0f4udjmot9TDQPF07pSqABlhz1ejSC3AKOJDym+
  -o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYD
  -VR0OBBYEFDoU1EzaIZxR2ktTe35M8ILp07mdMB8GA1UdIwQYMBaAFDutonHmNL0b
  -/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDov
  -L3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
  -dF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5l
  -dC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwA
  -MIGIAkIBsRpAWU0SxP3lwtUrriS8Dtal1vh2vfBMUzvx8hzjHGSYCg3xlG2cfnXN
  -lFIhsQaWUmiJFZg8m+rCdYNkUMsdpeACQgCCHUls+Tf5Kcc756qs2iC2JSf2yd2U
  -EM7VAJqZRVG9HrCUnzDLJT7bIQswE6i/O1zNhKjYV9xgd6LW+XCF0cVB7A==
  ------END CERTIFICATE-----

• File[/etc/cfssl/signers/discovery/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/discovery/ca].orig
  +++ File[/etc/cfssl/signers/discovery/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer
  

• File[/etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf].orig
  +++ File[/etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf.orig
  +++ /etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "wmf_auto_restart_ulogd2" then {
  -    action(
  -        type="omfile" file="/var/log/wmf_auto_restart_ulogd2/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Systemd::Timer::Job[nrpe2nodexp-check_cfssl-multirootca_status]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_cfssl-multirootca_status].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_cfssl-multirootca_status]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_cfssl-multirootca_status command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "52832284a5fb8b8ea6f55bb6271912c9" --timeout 10 --check-command "check_check_cfssl-multirootca_status" --page
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_cfssl-multirootca_status
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 300
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/wikikube_front_proxy/cfssl.conf.orig
  +++ /etc/cfssl/signers/wikikube_front_proxy/cfssl.conf
  @@ -1,64 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "signing",
  -        "key encipherment",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/wikikube_front_proxy",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/wikikube_front_proxy"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem].orig
  +++ File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem.orig
  +++ /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDtzCCAxigAwIBAgIUIw4+rszPiPmnvGoMBfrD29oWNKcwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
  -gTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  -GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
  -aW9uczEcMBoGA1UEAwwTbWxzZXJ2ZV9mcm9udF9wcm94eTCBmzAQBgcqhkjOPQIB
  -BgUrgQQAIwOBhgAEATdxtFPSx+kYYz4a6PyKfBi000SHiFxHSQqS71Bs13jbumD2
  -h6uPdTyD3dT79AdxQVzoer7inVQZM1vz5ZioLN0mAVH9OdSm8NLPpy9CAjT/2puk
  -6PZWtowGmcoOkXeZeZDIUOYam0f4udjmot9TDQPF07pSqABlhz1ejSC3AKOJDym+
  -o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYD
  -VR0OBBYEFDoU1EzaIZxR2ktTe35M8ILp07mdMB8GA1UdIwQYMBaAFDutonHmNL0b
  -/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDov
  -L3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
  -dF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5l
  -dC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwA
  -MIGIAkIBsRpAWU0SxP3lwtUrriS8Dtal1vh2vfBMUzvx8hzjHGSYCg3xlG2cfnXN
  -lFIhsQaWUmiJFZg8m+rCdYNkUMsdpeACQgCCHUls+Tf5Kcc756qs2iC2JSf2yd2U
  -EM7VAJqZRVG9HrCUnzDLJT7bIQswE6i/O1zNhKjYV9xgd6LW+XCF0cVB7A==
  ------END CERTIFICATE-----

• Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_dse command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "4384c5ebc49e03dbe331e279fac3f393" --timeout 10 --check-command "check_check_certificate_expiry_dse"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_dse
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/cfssl/signers/discovery/ca/discovery-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/discovery/ca/discovery-key.pem].orig
  +++ File[/etc/cfssl/signers/discovery/ca/discovery-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/discovery/ca/discovery-key.pem.orig
  +++ /etc/cfssl/signers/discovery/ca/discovery-key.pem
  @@ -1 +0,0 @@
  -##### FAKE FOR PUPPET ######

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: aux
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_aux!10
  

• File[/etc/sudoers.d/nrpe-check_check_cfssl-multirootca_status]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_cfssl-multirootca_status].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_cfssl-multirootca_status]
  
  -    require => Package[nagios-nrpe-server]
  -    ensure  => absent
  -    group   => root
  -    owner   => root
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_cassandra]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem

• Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-aux_front_proxy.timer
  

• Ferm::Filter_log[filter-bootp]

  Parameters differences:

  --- Ferm::Filter_log[filter-bootp].orig
  +++ Ferm::Filter_log[filter-bootp]
  
  -    sport  => 67
  -    ensure => present
  -    proto  => udp
  -    daddr  => 255.255.255.255
  -    dport  => 68
  

• Httpd::Mod_conf[ssl]

  Parameters differences:

  --- Httpd::Mod_conf[ssl].orig
  +++ Httpd::Mod_conf[ssl]
  
  -    mod      => ssl
  -    ensure   => present
  -    loadfile => ssl.load
  

• File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft
  @@ -0,0 +1,38 @@
  +# Autogenerated by puppet
  +set ANALYTICS_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 10.64.137.0/24,
  +             10.64.138.0/24,
  +             10.64.139.0/24,
  +             10.64.140.0/24,
  +             10.64.142.0/24,
  +             10.64.143.0/24,
  +             10.64.144.0/24,
  +             10.64.145.0/24,
  +             10.64.153.0/24,
  +             10.64.155.0/24,
  +             10.64.157.0/24,
  +             10.64.159.0/24,
  +             10.64.161.0/24,
  +             10.64.163.0/24,
  +             10.64.165.0/24,
  +             10.64.167.0/24,
  +             10.64.170.0/24,
  +             10.64.172.0/24,
  +             10.64.174.0/24,
  +             10.64.176.0/24,
  +             10.64.178.0/24,
  +             10.64.180.0/24,
  +             10.64.182.0/24,
  +             10.64.184.0/24,
  +             10.64.186.0/24,
  +             10.64.188.0/24,
  +             10.64.190.0/24,
  +             10.64.21.0/24,
  +             10.64.36.0/24,
  +             10.64.5.0/24,
  +             10.64.53.0/24
  +    }
  +}

• Prometheus::Node_textfile[prometheus-check-discovery2026-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-discovery2026-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-discovery2026-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-discovery2026-certificate-expiry --cert-path /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --outfile /var/lib/prometheus/node.d/discovery2026_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_wikikube_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
  
  -    ensure => present
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Cfssl::Signer[wikikube]

  Parameters differences:

  --- Cfssl::Signer[wikikube].orig
  +++ Cfssl::Signer[wikikube]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/wikikube/ca/wikikube.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDqzCCAwygAwIBAgIUWXrkQs5GEdgVcV7/XAEZOXQLYlowCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB2
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMREwDwYDVQQDEwh3aWtpa3ViZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAE
  AX4fMTh3NrBZlCMop5eKr6F/RXTefrSSdu6DE39OOKTTdYM3TxK8tPmTDm9EE+XT
  4rO+VHuaIVVirgB2JQtla8oZAZb60Pw8v9BlJ1JLLK9vpWA9Vce7DKmMNxIWK9GA
  YIUQufjHVD2eibYJsK54NGkBe3frhPhwayIvzJ3gGO34GRaRo4IBDDCCAQgwDgYD
  VR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFAaU1Sae
  B9+FDd+SrIADU8yIo+xJMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2
  MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zl
  cnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8E
  QzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1l
  ZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBFZVjRbh3
  GaouRaz9IPef3q+9s+TleKGby7nJQ6z71M3rpJIsHr9lncr/9GPq5v5cHDYOHmgK
  GBupTY7FNMwL8aACQgCgoDP6PO23Dw6tuswLIbeY+o5l3K8R5L3RS1DO59OXXV2f
  9FmoJNLgGXgP87rOkFW1fn9/QcvX85zD0urkq8gNjg==
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => test
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/wikikube
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/wikikube
  -    ca_key_file      => /etc/cfssl/signers/wikikube/ca/wikikube-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages   => ['signing', 'key encipherment', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• Exec[Generate initial CRL for wikikube_staging_front_proxy]

  Parameters differences:

  --- Exec[Generate initial CRL for wikikube_staging_front_proxy].orig
  +++ Exec[Generate initial CRL for wikikube_staging_front_proxy]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/wikikube_staging_front_proxy
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/wikikube_staging_front_proxy
  

• File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Sudo::User[nrpe_certificate_check_puppet_rsa]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_puppet_rsa].orig
  +++ Sudo::User[nrpe_certificate_check_puppet_rsa]
  
  -    user       => nrpe_certificate_check_puppet_rsa
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• Systemd::Service[cfssl-ocspserve@dse_front_proxy]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@dse_front_proxy].orig
  +++ Systemd::Service[cfssl-ocspserve@dse_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Syslog[cfssl-ocsprefresh-cassandra]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-cassandra].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-cassandra]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/sudoers.d/nrpe_certificate_check_zuul]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_zuul].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_zuul]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Systemd::Timer[cfssl-ocsprefresh-mlserve_front_proxy]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-mlserve_front_proxy].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-mlserve_front_proxy]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-mlserve_front_proxy.service
  

• Exec[Generate initial CRL for etcd]

  Parameters differences:

  --- Exec[Generate initial CRL for etcd].orig
  +++ Exec[Generate initial CRL for etcd]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/etcd/ca/etcd.pem /etc/cfssl/signers/etcd/ca/etcd-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/etcd
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/etcd
  

• File[/etc/cfssl/ocsp/dse.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/dse.ocsp].orig
  +++ File[/etc/cfssl/ocsp/dse.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Prometheus::Blackbox::Check::Http[PKI_aux]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_aux].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_aux]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"aux"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Systemd::Timer::Job[wmf_auto_restart_apache2]

  Parameters differences:

  --- Systemd::Timer::Job[wmf_auto_restart_apache2].orig
  +++ Systemd::Timer::Job[wmf_auto_restart_apache2]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 22:8:00'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Auto restart job: apache2
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/wmf-auto-restart -s apache2
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    require                   => File[/usr/local/sbin/wmf-auto-restart]
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_staging_front_proxy command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "b194b5b9b6c9d6e05b9eed8dcfcc40cf" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_staging_front_proxy"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/cfssl/signers/dse_front_proxy/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/dse_front_proxy/ca].orig
  +++ File[/etc/cfssl/signers/dse_front_proxy/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Exec[ensure_present_mod_status]

  Parameters differences:

  --- Exec[ensure_present_mod_status].orig
  +++ Exec[ensure_present_mod_status]
  
  -    command => /usr/sbin/a2enmod status
  -    notify  => Service[apache2]
  -    require => Package[apache2]
  -    creates => /etc/apache2/mods-enabled/status.load
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-dse.timer]']
  -    refreshonly => True
  

• Class[Cumin::Selector]

  Parameters differences:

  --- Class[Cumin::Selector].orig
  +++ Class[Cumin::Selector]
  
  @@
  -    cluster => pki
  +    cluster => insetup
  

• Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@kafka]']
  -    refreshonly => True
  

• File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_network_devices.service
  

• Nftables::Set[DRUID_PUBLIC_HOSTS]

  Parameters differences:

  --- Nftables::Set[DRUID_PUBLIC_HOSTS].orig
  +++ Nftables::Set[DRUID_PUBLIC_HOSTS]
  
  +    hosts  => ['10.64.131.9', '2620:0:861:10a:10:64:131:9', '10.64.132.12', '2620:0:861:10b:10:64:132:12', '10.64.135.9', '2620:0:861:10e:10:64:135:9', '10.64.32.101', '2620:0:861:103:10:64:32:101', '10.64.48.185', '2620:0:861:107:10:64:48:185']
  +    ensure => present
  

• Exec[renew certificate - OCSP_wikikube_staging_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_wikikube_staging_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_wikikube_staging_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Systemd::Syslog[cfssl-ocsprefresh-network_devices]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-network_devices].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-network_devices]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf]

  Parameters differences:

  --- File[/etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf].orig
  +++ File[/etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf]
  
  -    notify => Service[apache2]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf.orig
  +++ /etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf
  @@ -1 +0,0 @@
  -Listen 8443

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Nftables::Set[DEPLOYMENT_HOSTS]

  Parameters differences:

  --- Nftables::Set[DEPLOYMENT_HOSTS].orig
  +++ Nftables::Set[DEPLOYMENT_HOSTS]
  
  +    hosts  => ['10.64.16.93', '2620:0:861:102:10:64:16:93', '10.192.32.7', '2620:0:860:103:10:192:32:7']
  +    ensure => present
  

• File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Systemd::Monitor[cfssl-multirootca]

  Parameters differences:

  --- Systemd::Monitor[cfssl-multirootca].orig
  +++ Systemd::Monitor[cfssl-multirootca]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 10
  -    critical       => True
  -    retries        => 2
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-dse_front_proxy.timer]']
  -    refreshonly => True
  

• Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-mlserve_staging_front_proxy.timer
  

• Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - aux_front_proxy
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --responses-file /etc/cfssl/ocsp/aux_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@aux_front_proxy' aux_front_proxy 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-wikikube.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-wikikube.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - wikikube
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube/ca/wikikube.pem --responses-file /etc/cfssl/ocsp/wikikube.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube' wikikube 

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-debmonitor-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-debmonitor-certificate-expiry --cert-path /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --outfile /var/lib/prometheus/node.d/debmonitor_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Unit[cfssl-ocsprefresh-discovery2026.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-discovery2026.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-discovery2026.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-discovery2026.timer
  

• Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube -profile ocsp /etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• Monitoring::Exported_nagios_service[pki1001 check_cfssl-multirootca_status]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_cfssl-multirootca_status].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_cfssl-multirootca_status]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 240
  -    contact_groups         => admins,sms,admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 10
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 2
  -    host_name              => pki1001
  -    service_description    => Check unit status of cfssl-multirootca #page
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_cfssl-multirootca_status!10
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/var/log/cfssl-ocsprefresh-dse]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-dse].orig
  +++ File[/var/log/cfssl-ocsprefresh-dse]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

  Parameters differences:

  --- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
  +++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.orig
  +++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry
  -
  -/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-wikikube_staging.timer]']
  -    refreshonly => True
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-dse-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-dse-certificate-expiry --cert-path /etc/cfssl/signers/dse/ca/dse.pem --outfile /var/lib/prometheus/node.d/dse_intermediate.prom

• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-mlserve.timer]']
  -    refreshonly => True
  

• Cfssl::Ocsp[dse]

  Parameters differences:

  --- Cfssl::Ocsp[dse].orig
  +++ Cfssl::Ocsp[dse]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/dse/ca/dse.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 20061
  -    db_driver          => mysql
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• Cfssl::Config[aux]

  Parameters differences:

  --- Cfssl::Config[aux].orig
  +++ Cfssl::Config[aux]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/aux/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/aux
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/aux
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages      => ['signing', 'key encipherment', 'client auth']
  

• File[/usr/local/sbin/cfssl-certs]

  Parameters differences:

  --- File[/usr/local/sbin/cfssl-certs].orig
  +++ File[/usr/local/sbin/cfssl-certs]
  
  -    ensure => file
  -    owner  => root
  -    source => puppet:///modules/cfssl/cfssl_certs.py
  -    mode   => 0500
  -    group  => root
  

• File[/etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp].orig
  +++ File[/etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-aux_front_proxy" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-aux_front_proxy/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Systemd::Service[cfssl-ocsprefresh-wikikube]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-wikikube].orig
  +++ Systemd::Service[cfssl-ocsprefresh-wikikube]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-wikikube.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Sudo::User[nrpe_certificate_check_mlserve_staging_front_proxy]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_mlserve_staging_front_proxy].orig
  +++ Sudo::User[nrpe_certificate_check_mlserve_staging_front_proxy]
  
  -    user       => nrpe_certificate_check_mlserve_staging_front_proxy
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy].orig
  +++ File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Service[cfssl-ocspserve@mlserve_front_proxy]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@mlserve_front_proxy].orig
  +++ Systemd::Service[cfssl-ocspserve@mlserve_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cloud_wmnet_ca.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cloud_wmnet_ca.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cloud_wmnet_ca.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Alternatives::Select[ip6tables]

  Parameters differences:

  --- Alternatives::Select[ip6tables].orig
  +++ Alternatives::Select[ip6tables]
  
  -    require => Package[iptables]
  -    path    => /usr/sbin/ip6tables-legacy
  

• Cfssl::Ocsp[wikikube_staging]

  Parameters differences:

  --- Cfssl::Ocsp[wikikube_staging].orig
  +++ Cfssl::Ocsp[wikikube_staging]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 20020
  -    db_driver          => mysql
  

• Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet].orig
  +++ Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery2026 -profile ocsp /etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem 2>&1)"
  
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@aux]']
  -    refreshonly => True
  

• Systemd::Timer[nrpe2nodexp-check_cfssl-multirootca_status]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_cfssl-multirootca_status].orig
  +++ Systemd::Timer[nrpe2nodexp-check_cfssl-multirootca_status]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 300
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_cfssl-multirootca_status.service
  

• Nftables::Set[LABS_NETWORKS]

  Parameters differences:

  --- Nftables::Set[LABS_NETWORKS].orig
  +++ Nftables::Set[LABS_NETWORKS]
  
  +    hosts  => ['172.16.0.0/21', '172.16.128.0/24', '172.16.129.0/24', '172.16.130.0/24', '172.16.131.0/24', '172.16.16.0/21', '172.16.24.0/24', '172.16.8.0/21', '172.20.1.0/24', '172.20.2.0/24', '172.20.254.0/24', '172.20.255.0/24', '172.20.3.0/24', '172.20.4.0/24', '172.20.5.0/24', '185.15.56.0/25', '185.15.56.160/28', '185.15.57.0/29', '185.15.57.16/29', '185.15.57.24/29', '2a02:ec80:a000:100::/64', '2a02:ec80:a000:1::/64', '2a02:ec80:a000:201::/64', '2a02:ec80:a000:202::/64', '2a02:ec80:a000:203::/64', '2a02:ec80:a000:204::/64', '2a02:ec80:a000:2ff::/64', '2a02:ec80:a000:4000::/64', '2a02:ec80:a100:100::/64', '2a02:ec80:a100:1::/64', '2a02:ec80:a100:205::/64', '2a02:ec80:a100:2ff::/64', '2a02:ec80:a100:4000::/64']
  +    ensure => present
  

• Cfssl::Config[discovery2026]

  Parameters differences:

  --- Cfssl::Config[discovery2026].orig
  +++ Cfssl::Config[discovery2026]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/discovery2026/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/discovery2026
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/discovery2026
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}
  -    default_usages      => ['digital signature', 'key encipherment', 'server auth']
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-mlserve_staging-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
  

• Prometheus::Node_textfile[check-nft]

  Parameters differences:

  --- Prometheus::Node_textfile[check-nft].orig
  +++ Prometheus::Node_textfile[check-nft]
  
  +    ensure         => present
  +    interval       => *:0/30
  +    user           => root
  +    filesource     => puppet:///modules/profile/firewall/check_nftables.py
  +    run_cmd        => /usr/local/bin/check-nft
  +    environment    => {}
  +    extra_packages => []
  

• Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-ocspserve@zuul]']
  -    refreshonly => True
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
  

• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - wikikube_front_proxy
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --responses-file /etc/cfssl/ocsp/wikikube_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_front_proxy' wikikube_front_proxy 

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/signers/kafka/ca/kafka.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/kafka/ca/kafka.pem].orig
  +++ File[/etc/cfssl/signers/kafka/ca/kafka.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/kafka/ca/kafka.pem.orig
  +++ /etc/cfssl/signers/kafka/ca/kafka.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDqDCCAwmgAwIBAgIUTWT2navXkMW9fz3oUB7Fc6azbKcwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjExMDI4MTMwNjAwWhcNMjYxMDI3MTMwNjAwWjBz
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMQ4wDAYDVQQDEwVrYWZrYTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAScI
  -AVY36upnobdfvpQJ7Y5uefRAv0OsdtR++HEqm2kTatOG4BJTdjdBv3+gyd3rJccd
  -DEifyU1EcxVVXjjXzqdHADiJ+Zol5mwexbnrpF8JDBiJv7ntNamdr7Xjv4kw8Tkp
  -kgl70aFalPLjpwjDNyrm2ACxPmHxK8EOu7eXb8RImqeVo4IBDDCCAQgwDgYDVR0P
  -AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFGIY/nB0tTtl
  -RGdO5J4ck+RM8p8rMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2MFYG
  -CCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zlcnku
  -d21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBB
  -MD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1lZGlh
  -X0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBv8ZMP7g8aPkc
  -tcrO4rXcBkhFIWH9+4H4iTbuSBtjVtUXdsRW++IU89BjVVKQxv/4ZDm8hlpd+vJU
  -b9xj3WUpi8cCQgFpjYqKVM+I5eRpIjhWoPxognJtGI3626wAOpV2CPauciD51gP3
  -up2xe36OG3Z8XDcbNGoNiG3505+af9zBrt3c4g==
  ------END CERTIFICATE-----

• Systemd::Unit[cfssl-ocsprefresh-network_devices.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-network_devices.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-network_devices.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-network_devices.timer
  

• Httpd::Conf[pki.discovery.wmnet]

  Parameters differences:

  --- Httpd::Conf[pki.discovery.wmnet].orig
  +++ Httpd::Conf[pki.discovery.wmnet]
  
  -    priority  => 50
  -    conf_type => sites
  -    ensure    => present
  

• Firewall::Service[multirootca-tls-termination-for-cfssl-issuer-k8s-pods]

  Parameters differences:

  --- Firewall::Service[multirootca-tls-termination-for-cfssl-issuer-k8s-pods].orig
  +++ Firewall::Service[multirootca-tls-termination-for-cfssl-issuer-k8s-pods]
  
  -    ensure              => present
  -    port                => 8443
  -    prio                => 10
  -    desc                => 
  -    src_sets            => ['WIKIKUBE_KUBEPODS_NETWORKS', 'STAGING_KUBEPODS_NETWORKS', 'MLSERVE_KUBEPODS_NETWORKS', 'MLSTAGE_KUBEPODS_NETWORKS', 'DSE_KUBEPODS_NETWORKS', 'AUX_KUBEPODS_NETWORKS']
  -    proto               => tcp
  -    unrestricted_access => False
  -    notrack             => False
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse_front_proxy]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse_front_proxy].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse_front_proxy]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: dse_front_proxy
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_dse_front_proxy!10
  

• Exec[renew certificate - OCSP_kafka_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_kafka_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_kafka_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label kafka -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem -checkend 952200
  

• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_aux" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Profile::Auto_restarts::Service[ulogd2]

  Parameters differences:

  --- Profile::Auto_restarts::Service[ulogd2].orig
  +++ Profile::Auto_restarts::Service[ulogd2]
  
  -    ensure => present
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
  

• File[/etc/ferm/conf.d/98_log-everything]

  Parameters differences:

  --- File[/etc/ferm/conf.d/98_log-everything].orig
  +++ File[/etc/ferm/conf.d/98_log-everything]
  
  -    notify  => Service[ferm]
  -    require => File[/etc/ferm/conf.d]
  -    ensure  => present
  -    owner   => root
  -    tag     => ferm
  -    mode    => 0400
  -    group   => root
  

  Content differences:

  --- /etc/ferm/conf.d/98_log-everything.orig
  +++ /etc/ferm/conf.d/98_log-everything
  @@ -1,11 +0,0 @@
  -# Autogenerated by puppet. DO NOT EDIT BY HAND!
  -#
  -# 98_log-everything: 
  -
  -domain (ip ip6) {
  -	table filter {
  -		chain INPUT {
  -			NFLOG mod limit limit 1/second limit-burst 5 nflog-prefix "[fw-in-drop]";
  -		}
  -	}
  -}

• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Service[nrpe2nodexp-check_certificate_expiry_dse.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_dse.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_dse.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]']
  

• File[/etc/sudoers.d/nrpe_certificate_check_discovery2026]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_discovery2026].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_discovery2026]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• File[/etc/sudoers.d/nrpe_certificate_check_debmonitor]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_debmonitor].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_debmonitor]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Systemd::Unit[nrpe2nodexp-ferm_active.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-ferm_active.service].orig
  +++ Systemd::Unit[nrpe2nodexp-ferm_active.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-ferm_active.service
  

• File[/etc/nftables/sets/BASTION_HOSTS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/BASTION_HOSTS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/BASTION_HOSTS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/BASTION_HOSTS_ipv4.nft.orig
  +++ /etc/nftables/sets/BASTION_HOSTS_ipv4.nft
  @@ -0,0 +1,12 @@
  +# Autogenerated by puppet
  +set BASTION_HOSTS_ipv4 {
  +    type ipv4_addr
  +    elements = { 208.80.154.7,
  +             208.80.153.110,
  +             185.15.59.99,
  +             198.35.26.104,
  +             103.102.166.103,
  +             185.15.58.6,
  +             195.200.68.99
  +    }
  +}

• Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_network_devices.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_network_devices.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_network_devices.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.service (nrpe2nodexp-ferm_active.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.service (nrpe2nodexp-ferm_active.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.service (nrpe2nodexp-ferm_active.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_discovery.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_discovery.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/cfssl/signers/wikikube/ca/wikikube-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube/ca/wikikube-key.pem].orig
  +++ File[/etc/cfssl/signers/wikikube/ca/wikikube-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/wikikube/ca/wikikube-key.pem.orig
  +++ /etc/cfssl/signers/wikikube/ca/wikikube-key.pem
  @@ -1 +0,0 @@
  -test

• File[/etc/cfssl/signers/syslog/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/syslog/ca].orig
  +++ File[/etc/cfssl/signers/syslog/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Systemd::Unit[cfssl-ocspserve@wikikube_staging]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@wikikube_staging].orig
  +++ Systemd::Unit[cfssl-ocspserve@wikikube_staging]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@wikikube_staging
  

• Systemd::Unit[cfssl-ocsprefresh-cassandra.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-cassandra.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-cassandra.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-cassandra.service
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer
  

• Sudo::User[nrpe_certificate_check_discovery2026]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_discovery2026].orig
  +++ Sudo::User[nrpe_certificate_check_discovery2026]
  
  -    user       => nrpe_certificate_check_discovery2026
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• File[/lib/systemd/system/cfssl-ocspserve@aux.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@aux.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@aux.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@aux.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@aux.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (aux)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 20050 \
  -          -responses /etc/cfssl/ocsp/aux.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Nrpe::Monitor_service[check_certificate_expiry_network_devices]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_network_devices].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_network_devices]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: network_devices
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem
  -    timeout                     => 10
  

• File[/etc/sudoers.d/nrpe_certificate_check_dse_front_proxy]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_dse_front_proxy].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_dse_front_proxy]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Nrpe::Check[check_check_certificate_expiry_discovery2026]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_discovery2026].orig
  +++ Nrpe::Check[check_check_certificate_expiry_discovery2026]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
  -    before    => Monitoring::Service[check_certificate_expiry_discovery2026]
  -    ensure    => present
  -    sudo_user => root
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_kafka]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem

• File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf.orig
  +++ /etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf
  @@ -1,64 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "digital signature",
  -        "key encipherment",
  -        "server auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/cloud_wmnet_ca",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/cloud_wmnet_ca"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Systemd::Service[cfssl-ocsprefresh-dse]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-dse].orig
  +++ Systemd::Service[cfssl-ocsprefresh-dse]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-dse.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Unit[cfssl-ocspserve@mlserve_staging_front_proxy]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@mlserve_staging_front_proxy].orig
  +++ Systemd::Unit[cfssl-ocspserve@mlserve_staging_front_proxy]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@mlserve_staging_front_proxy
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cassandra]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cassandra].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cassandra]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_cassandra command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "f5e260f525c48c963fb2e6c86a0d5d63" --timeout 10 --check-command "check_check_certificate_expiry_cassandra"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_cassandra
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/var/log/cfssl-ocsprefresh-dse_front_proxy]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-dse_front_proxy].orig
  +++ File[/var/log/cfssl-ocsprefresh-dse_front_proxy]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
  

• Prometheus::Blackbox::Check::Http[PKI_mlserve_staging]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_mlserve_staging].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_mlserve_staging]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"mlserve_staging"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/cfssl/ocsp/aux_front_proxy.ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ocsp/aux_front_proxy.ocsp].orig
  +++ File[/etc/cfssl/ocsp/aux_front_proxy.ocsp]
  
  -    ensure => file
  -    group  => root
  -    owner  => root
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux_front_proxy].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
  

• Systemd::Unit[cfssl-ocspserve@network_devices]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@network_devices].orig
  +++ Systemd::Unit[cfssl-ocspserve@network_devices]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@network_devices
  

• Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]']
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]']
  -    refreshonly => True
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-etcd-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Service[cfssl-ocsprefresh-kafka.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-kafka.timer].orig
  +++ Service[cfssl-ocsprefresh-kafka.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label kafka -profile ocsp /etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• Systemd::Timer[cfssl-ocsprefresh-wikikube_front_proxy]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-wikikube_front_proxy].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-wikikube_front_proxy]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-wikikube_front_proxy.service
  

• Systemd::Timer[cfssl-ocsprefresh-cloud_wmnet_ca]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-cloud_wmnet_ca].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-cloud_wmnet_ca]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-cloud_wmnet_ca.service
  

• File[/etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft]

  Parameters differences:

  --- File[/etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft].orig
  +++ File[/etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft.orig
  +++ /etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft
  @@ -0,0 +1,4 @@
  +# Managed by puppet
  +# 
  +ip saddr { 10.64.0.82, 10.64.16.62, 10.64.32.85, 10.64.48.171, 208.80.153.42, 208.80.154.78 } tcp dport 1-65535 accept
  +ip6 saddr { 2620:0:860:2:208:80:153:42, 2620:0:861:101:10:64:0:82, 2620:0:861:102:10:64:16:62, 2620:0:861:103:10:64:32:85, 2620:0:861:107:10:64:48:171, 2620:0:861:3:208:80:154:78 } tcp dport 1-65535 accept

• Prometheus::Blackbox::Check::Http[PKI_wikikube_front_proxy]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_wikikube_front_proxy].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_wikikube_front_proxy]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"wikikube_front_proxy"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Cfssl::Ocsp[discovery2026]

  Parameters differences:

  --- Cfssl::Ocsp[discovery2026].orig
  +++ Cfssl::Ocsp[discovery2026]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 10010
  -    db_driver          => mysql
  

• Service[cfssl-ocsprefresh-aux.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-aux.timer].orig
  +++ Service[cfssl-ocsprefresh-aux.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)].orig
  +++ Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Syslog[cfssl-ocsprefresh-etcd]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-etcd].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-etcd]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label zuul -profile ocsp /etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Systemd::Timer::Job[wmf_auto_restart_apache-htcacheclean]

  Parameters differences:

  --- Systemd::Timer::Job[wmf_auto_restart_apache-htcacheclean].orig
  +++ Systemd::Timer::Job[wmf_auto_restart_apache-htcacheclean]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 3:51:00'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Auto restart job: apache-htcacheclean
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/wmf-auto-restart -s apache-htcacheclean
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    require                   => File[/usr/local/sbin/wmf-auto-restart]
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Service[cfssl-ocspserve@wikikube]

  Parameters differences:

  --- Service[cfssl-ocspserve@wikikube].orig
  +++ Service[cfssl-ocspserve@wikikube]
  
  -    ensure => running
  -    enable => True
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• File[/etc/cfssl/signers/kafka/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/kafka/ca].orig
  +++ File[/etc/cfssl/signers/kafka/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Nftables::Set[KAFKA_BROKERS_LOGGING]

  Parameters differences:

  --- Nftables::Set[KAFKA_BROKERS_LOGGING].orig
  +++ Nftables::Set[KAFKA_BROKERS_LOGGING]
  
  +    hosts  => ['10.64.16.205', '2620:0:861:102:10:64:16:205', '10.64.133.11', '2620:0:861:10c:10:64:133:11', '10.64.183.12', '2620:0:861:13d:10:64:183:12', '10.64.131.13', '2620:0:861:10a:10:64:131:13', '10.64.135.13', '2620:0:861:10e:10:64:135:13', '10.192.23.29', '2620:0:860:113:10:192:23:29', '10.192.11.28', '2620:0:860:10c:10:192:11:28', '10.192.26.22', '2620:0:860:105:10:192:26:22', '10.192.11.27', '2620:0:860:10c:10:192:11:27', '10.192.39.25', '2620:0:860:11e:10:192:39:25']
  +    ensure => present
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_mlserve" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• Class[Profile::Firewall::Log::Ferm]

  Parameters differences:

  --- Class[Profile::Firewall::Log::Ferm].orig
  +++ Class[Profile::Firewall::Log::Ferm]
  
  -    log_burst     => 5
  -    log_rate      => 1/second
  -    separate_file => True
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]']
  -    refreshonly => True
  

• Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

  Parameters differences:

  --- Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
  +++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/ferm/conf.d/10_multirootca_tls_termination]

  Parameters differences:

  --- File[/etc/ferm/conf.d/10_multirootca_tls_termination].orig
  +++ File[/etc/ferm/conf.d/10_multirootca_tls_termination]
  
  -    notify  => Service[ferm]
  -    require => File[/etc/ferm/conf.d]
  -    ensure  => present
  -    owner   => root
  -    tag     => ferm
  -    mode    => 0400
  -    group   => root
  

  Content differences:

  --- /etc/ferm/conf.d/10_multirootca_tls_termination.orig
  +++ /etc/ferm/conf.d/10_multirootca_tls_termination
  @@ -1,6 +0,0 @@
  -# Autogenerated by puppet. DO NOT EDIT BY HAND!
  -#
  -# 
  -&R_SERVICE(tcp, 443, $DOMAIN_NETWORKS);
  -
  -

• File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem].orig
  +++ File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem.orig
  +++ /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem
  @@ -1 +0,0 @@
  -nosecret

• Exec[renew certificate - OCSP_puppet_rsa_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_puppet_rsa_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_puppet_rsa_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Exec[renew certificate - OCSP_mlserve_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_mlserve_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_mlserve_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Nftables::Set[ZOOKEEPER_FLINK_HOSTS]

  Parameters differences:

  --- Nftables::Set[ZOOKEEPER_FLINK_HOSTS].orig
  +++ Nftables::Set[ZOOKEEPER_FLINK_HOSTS]
  
  +    hosts  => ['10.64.16.9', '2620:0:861:102:10:64:16:9', '10.64.0.8', '2620:0:861:101:10:64:0:8', '10.64.32.41', '2620:0:861:103:10:64:32:41', '10.192.16.227', '2620:0:860:102:10:192:16:227', '10.192.32.179', '2620:0:860:103:10:192:32:179', '10.192.48.219', '2620:0:860:104:10:192:48:219']
  +    ensure => present
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer
  

• File[/etc/update-motd.d/05-insetup--infrastructure-foundations-nftables]

  Parameters differences:

  --- File[/etc/update-motd.d/05-insetup--infrastructure-foundations-nftables].orig
  +++ File[/etc/update-motd.d/05-insetup--infrastructure-foundations-nftables]
  
  +    ensure => present
  +    mode   => 0555
  +    group  => root
  +    owner  => root
  

  Content differences:

  --- /etc/update-motd.d/05-insetup--infrastructure-foundations-nftables.orig
  +++ /etc/update-motd.d/05-insetup--infrastructure-foundations-nftables
  @@ -0,0 +1,2 @@
  +#!/bin/sh
  +printf "%s\n" "pki1001 is a Host being setup by Infrastructure Foundations SREs with ntables (insetup::infrastructure_foundations_nftables)"

• Exec[renew certificate - OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
  

• File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-mlserve_front_proxy
  -
  -/var/log/cfssl-ocsprefresh-mlserve_front_proxy/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• Systemd::Syslog[wmf_auto_restart_apache-htcacheclean]

  Parameters differences:

  --- Systemd::Syslog[wmf_auto_restart_apache-htcacheclean].orig
  +++ Systemd::Syslog[wmf_auto_restart_apache-htcacheclean]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => absent
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Monitoring::Exported_nagios_service[pki1001 ssh]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 ssh].orig
  +++ Monitoring::Exported_nagios_service[pki1001 ssh]
  
  @@
  -    servicegroups         => pki_eqiad
  +    servicegroups         => insetup_eqiad
  @@
  -    notifications_enabled => 1
  +    notifications_enabled => 0
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
  

• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Prometheus::Blackbox::Check::Http[PKI_wikikube]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_wikikube].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_wikikube]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"wikikube"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-debmonitor.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-debmonitor.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - debmonitor
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --responses-file /etc/cfssl/ocsp/debmonitor.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@debmonitor' debmonitor 

• Nftables::Set[PRODUCTION_NETWORKS]

  Parameters differences:

  --- Nftables::Set[PRODUCTION_NETWORKS].orig
  +++ Nftables::Set[PRODUCTION_NETWORKS]
  
  +    hosts  => ['10.128.0.0/24', '10.128.1.0/24', '10.128.2.0/24', '10.132.0.0/24', '10.132.2.0/24', '10.136.0.0/24', '10.136.1.0/24', '10.140.0.0/24', '10.140.1.0/24', '10.140.2.0/24', '10.192.0.0/22', '10.192.10.0/24', '10.192.11.0/24', '10.192.12.0/24', '10.192.13.0/24', '10.192.14.0/24', '10.192.15.0/24', '10.192.16.0/22', '10.192.20.0/24', '10.192.21.0/24', '10.192.22.0/24', '10.192.23.0/24', '10.192.24.0/23', '10.192.26.0/24', '10.192.27.0/24', '10.192.28.0/24', '10.192.29.0/24', '10.192.30.0/24', '10.192.31.0/24', '10.192.32.0/22', '10.192.36.0/24', '10.192.37.0/24', '10.192.38.0/24', '10.192.39.0/24', '10.192.4.0/24', '10.192.40.0/24', '10.192.41.0/24', '10.192.42.0/24', '10.192.43.0/24', '10.192.44.0/24', '10.192.45.0/24', '10.192.46.0/24', '10.192.47.0/24', '10.192.48.0/22', '10.192.5.0/24', '10.192.52.0/24', '10.192.56.0/24', '10.192.57.0/24', '10.192.58.0/24', '10.192.59.0/24', '10.192.6.0/24', '10.192.64.0/21', '10.192.7.0/24', '10.192.72.0/24', '10.192.76.0/24', '10.192.8.0/24', '10.192.80.0/20', '10.192.9.0/24', '10.192.96.0/21', '10.194.0.0/20', '10.194.128.0/17', '10.194.16.0/21', '10.194.61.0/24', '10.194.62.0/23', '10.194.64.0/20', '10.194.80.0/21', '10.2.1.0/24', '10.2.2.0/24', '10.2.3.0/24', '10.2.4.0/24', '10.2.5.0/24', '10.2.6.0/24', '10.2.7.0/24', '10.64.0.0/22', '10.64.130.0/24', '10.64.131.0/24', '10.64.132.0/24', '10.64.133.0/24', '10.64.134.0/24', '10.64.135.0/24', '10.64.136.0/24', '10.64.137.0/24', '10.64.138.0/24', '10.64.139.0/24', '10.64.140.0/24', '10.64.141.0/24', '10.64.142.0/24', '10.64.143.0/24', '10.64.144.0/24', '10.64.145.0/24', '10.64.148.0/24', '10.64.149.0/24', '10.64.150.0/24', '10.64.151.0/24', '10.64.152.0/24', '10.64.153.0/24', '10.64.154.0/24', '10.64.155.0/24', '10.64.156.0/24', '10.64.157.0/24', '10.64.158.0/24', '10.64.159.0/24', '10.64.16.0/22', '10.64.160.0/24', '10.64.161.0/24', '10.64.162.0/24', '10.64.163.0/24', '10.64.164.0/24', '10.64.165.0/24', '10.64.166.0/24', '10.64.167.0/24', '10.64.169.0/24', '10.64.170.0/24', '10.64.171.0/24', '10.64.172.0/24', '10.64.173.0/24', '10.64.174.0/24', '10.64.175.0/24', '10.64.176.0/24', '10.64.177.0/24', '10.64.178.0/24', '10.64.179.0/24', '10.64.180.0/24', '10.64.181.0/24', '10.64.182.0/24', '10.64.183.0/24', '10.64.184.0/24', '10.64.185.0/24', '10.64.186.0/24', '10.64.187.0/24', '10.64.188.0/24', '10.64.189.0/24', '10.64.190.0/24', '10.64.20.0/24', '10.64.21.0/24', '10.64.24.0/23', '10.64.32.0/22', '10.64.36.0/24', '10.64.48.0/22', '10.64.5.0/24', '10.64.53.0/24', '10.64.64.0/21', '10.64.72.0/24', '10.64.76.0/24', '10.67.0.0/20', '10.67.128.0/17', '10.67.16.0/21', '10.67.24.0/21', '10.67.32.0/20', '10.67.64.0/20', '10.67.80.0/21', '10.80.0.0/24', '10.80.1.0/24', '10.80.2.0/24', '103.102.166.0/28', '103.102.166.224/27', '103.102.166.96/27', '185.15.58.0/27', '185.15.58.224/27', '185.15.58.32/27', '185.15.59.0/27', '185.15.59.224/27', '185.15.59.32/27', '185.15.59.96/27', '195.200.68.0/27', '195.200.68.224/27', '195.200.68.32/27', '195.200.68.96/27', '198.35.26.0/27', '198.35.26.32/27', '198.35.26.96/27', '198.35.26.96/27', '2001:df2:e500:101::/64', '2001:df2:e500:103::/64', '2001:df2:e500:1::/64', '2001:df2:e500:3::/64', '2001:df2:e500:ed1a::/64', '208.80.152.128/27', '208.80.153.0/27', '208.80.153.224/27', '208.80.153.32/27', '208.80.153.64/27', '208.80.153.96/27', '208.80.154.0/26', '208.80.154.128/26', '208.80.154.224/27', '208.80.154.64/26', '208.80.155.96/27', '2620:0:860:100::/64', '2620:0:860:101::/64', '2620:0:860:102::/64', '2620:0:860:103::/64', '2620:0:860:104::/64', '2620:0:860:105::/64', '2620:0:860:106::/64', '2620:0:860:107::/64', '2620:0:860:108::/64', '2620:0:860:109::/64', '2620:0:860:10a::/64', '2620:0:860:10b::/64', '2620:0:860:10c::/64', '2620:0:860:10d::/64', '2620:0:860:10e::/64', '2620:0:860:10f::/64', '2620:0:860:110::/64', '2620:0:860:111::/64', '2620:0:860:112::/64', '2620:0:860:113::/64', '2620:0:860:114::/64', '2620:0:860:115::/64', '2620:0:860:116::/64', '2620:0:860:118::/64', '2620:0:860:119::/64', '2620:0:860:11a::/64', '2620:0:860:11b::/64', '2620:0:860:11c::/64', '2620:0:860:11d::/64', '2620:0:860:11e::/64', '2620:0:860:11f::/64', '2620:0:860:120::/64', '2620:0:860:121::/64', '2620:0:860:122::/64', '2620:0:860:123::/64', '2620:0:860:124::/64', '2620:0:860:125::/64', '2620:0:860:126::/64', '2620:0:860:127::/64', '2620:0:860:12b::/64', '2620:0:860:12c::/64', '2620:0:860:12d::/64', '2620:0:860:12e::/64', '2620:0:860:140::/64', '2620:0:860:1::/64', '2620:0:860:2::/64', '2620:0:860:300::/64', '2620:0:860:301::/64', '2620:0:860:302::/64', '2620:0:860:303::/64', '2620:0:860:304::/64', '2620:0:860:305::/64', '2620:0:860:307::/64', '2620:0:860:308::/64', '2620:0:860:3::/64', '2620:0:860:4::/64', '2620:0:860:5::/64', '2620:0:860:babe::/64', '2620:0:860:babf::/64', '2620:0:860:cabe::/64', '2620:0:860:cabf::/64', '2620:0:860:ed1a::/64', '2620:0:861:100::/64', '2620:0:861:101::/64', '2620:0:861:102::/64', '2620:0:861:103::/64', '2620:0:861:104::/64', '2620:0:861:105::/64', '2620:0:861:106::/64', '2620:0:861:107::/64', '2620:0:861:108::/64', '2620:0:861:109::/64', '2620:0:861:10a::/64', '2620:0:861:10b::/64', '2620:0:861:10c::/64', '2620:0:861:10d::/64', '2620:0:861:10e::/64', '2620:0:861:10f::/64', '2620:0:861:110::/64', '2620:0:861:111::/64', '2620:0:861:112::/64', '2620:0:861:113::/64', '2620:0:861:114::/64', '2620:0:861:115::/64', '2620:0:861:116::/64', '2620:0:861:117::/64', '2620:0:861:118::/64', '2620:0:861:119::/64', '2620:0:861:11a::/64', '2620:0:861:11c::/64', '2620:0:861:11d::/64', '2620:0:861:11e::/64', '2620:0:861:11f::/64', '2620:0:861:120::/64', '2620:0:861:121::/64', '2620:0:861:122::/64', '2620:0:861:123::/64', '2620:0:861:124::/64', '2620:0:861:125::/64', '2620:0:861:126::/64', '2620:0:861:127::/64', '2620:0:861:128::/64', '2620:0:861:129::/64', '2620:0:861:12a::/64', '2620:0:861:12b::/64', '2620:0:861:12c::/64', '2620:0:861:12d::/64', '2620:0:861:12e::/64', '2620:0:861:12f::/64', '2620:0:861:131::/64', '2620:0:861:132::/64', '2620:0:861:133::/64', '2620:0:861:134::/64', '2620:0:861:135::/64', '2620:0:861:136::/64', '2620:0:861:137::/64', '2620:0:861:138::/64', '2620:0:861:139::/64', '2620:0:861:13a::/64', '2620:0:861:13b::/64', '2620:0:861:13c::/64', '2620:0:861:13d::/64', '2620:0:861:13e::/64', '2620:0:861:13f::/64', '2620:0:861:140::/64', '2620:0:861:141::/64', '2620:0:861:142::/64', '2620:0:861:143::/64', '2620:0:861:144::/64', '2620:0:861:145::/64', '2620:0:861:1::/64', '2620:0:861:2::/64', '2620:0:861:300::/64', '2620:0:861:301::/116', '2620:0:861:302::/64', '2620:0:861:303::/116', '2620:0:861:304::/116', '2620:0:861:305::/64', '2620:0:861:3::/64', '2620:0:861:4::/64', '2620:0:861:babe::/64', '2620:0:861:babf::/116', '2620:0:861:cabe::/64', '2620:0:861:cabf::/116', '2620:0:861:ed1a::/64', '2620:0:863:101::/64', '2620:0:863:102::/64', '2620:0:863:103::/64', '2620:0:863:1::/64', '2620:0:863:2::/64', '2620:0:863:3::/64', '2620:0:863:ed1a::/64', '2a02:ec80:300:101::/64', '2a02:ec80:300:102::/64', '2a02:ec80:300:103::/64', '2a02:ec80:300:1::/64', '2a02:ec80:300:2::/64', '2a02:ec80:300:3::/64', '2a02:ec80:300:ed1a::/64', '2a02:ec80:600:101::/64', '2a02:ec80:600:102::/64', '2a02:ec80:600:1::/64', '2a02:ec80:600:2::/64', '2a02:ec80:600:ed1a::/64', '2a02:ec80:700:101::/64', '2a02:ec80:700:102::/64', '2a02:ec80:700:103::/64', '2a02:ec80:700:1::/64', '2a02:ec80:700:2::/64', '2a02:ec80:700:3::/64', '2a02:ec80:700:ed1a::/64']
  +    ensure => present
  

• Service[nrpe2nodexp-check_certificate_expiry_network_devices.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_network_devices.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_network_devices.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]']
  

• File[/etc/nftables/input]

  Parameters differences:

  --- File[/etc/nftables/input].orig
  +++ File[/etc/nftables/input]
  
  +    ensure  => directory
  +    purge   => True
  +    recurse => True
  +    owner   => root
  +    group   => root
  

• File[/etc/cfssl/signers/mlserve_front_proxy/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_front_proxy/ca].orig
  +++ File[/etc/cfssl/signers/mlserve_front_proxy/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-kafka.timer]']
  -    refreshonly => True
  

• File[/usr/local/bin/prometheus-check-dse-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-dse-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-dse-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
  
  -    ensure => present
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux_front_proxy]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux_front_proxy].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux_front_proxy]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: aux_front_proxy
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_aux_front_proxy!10
  

• File[/etc/sudoers.d/nrpe_certificate_check_etcd]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_etcd].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_etcd]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Syslog[cfssl-ocsprefresh-dse_front_proxy]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-dse_front_proxy].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-dse_front_proxy]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/nftables/sets/FRACK_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/FRACK_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/FRACK_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/FRACK_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/FRACK_NETWORKS_ipv6.nft
  @@ -0,0 +1,4 @@
  +# Autogenerated by puppet
  +set FRACK_NETWORKS_ipv6 {
  +    type ipv6_addr
  +}

• Service[cfssl-ocspserve@discovery]

  Parameters differences:

  --- Service[cfssl-ocspserve@discovery].orig
  +++ Service[cfssl-ocspserve@discovery]
  
  -    ensure => running
  -    enable => True
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
  

• Exec[ensure_present_mod_access_compat]

  Parameters differences:

  --- Exec[ensure_present_mod_access_compat].orig
  +++ Exec[ensure_present_mod_access_compat]
  
  -    command => /usr/sbin/a2enmod access_compat
  -    notify  => Service[apache2]
  -    require => Package[apache2]
  -    creates => /etc/apache2/mods-enabled/access_compat.load
  

• Nrpe::Check[check_check_certificate_expiry_syslog]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_syslog].orig
  +++ Nrpe::Check[check_check_certificate_expiry_syslog]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem
  -    before    => Monitoring::Service[check_certificate_expiry_syslog]
  -    ensure    => present
  -    sudo_user => root
  

• Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer].orig
  +++ Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Cfssl::Signer[cassandra]

  Parameters differences:

  --- Cfssl::Signer[cassandra].orig
  +++ Cfssl::Signer[cassandra]
  
  -    log_level        => info
  -    ca_file          => /etc/cfssl/signers/cassandra/ca/cassandra.pem
  -    default_expiry   => 672h
  -    db_conf_file     => /etc/cfssl/db.conf
  -    manage_services  => False
  -    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    ca_cert_content  => -----BEGIN CERTIFICATE-----
  MIIDqjCCAw2gAwIBAgIUN8PPoG0JeyUfDWKQhN0B2AOw4G8wCgYIKoZIzj0EAwQw
  gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjE5MTI1MDAwWhcNMjgwNjE3MTI1MDAwWjB3
  MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  b25zMRIwEAYDVQQDEwljYXNzYW5kcmEwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
  BABpd+xtElegZM2bsg1caGxmHV5hs7l7qxmKFS3oSAu1jo1+N/uSppDtSWZzG+8C
  zjIrytBMxBWhNqsOw9msEWhbBAEYESw1oKj+APqOlCafGdXQI1ZvMafexxTqDNN1
  CA2gq4ivn82r2Ya3LLqwICxK3MlcmGuLwR5amxiLchok3cZ3X6OCAQwwggEIMA4G
  A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQBN6m6
  eyaSV8l2Il/bwcfpWTmplDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
  NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
  ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
  BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
  ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GKADCBhgJBRhCSOg5L
  +EuYGdsW8T9S/tXzYURZpnQItn2nYjM6ky1nxqG6F+V2WsiijiPpEQxr7QUvfZhf
  D2zhB5BS8ynWCpYCQRGo4eZuUHyRMNqg/ZDljT1dqr09n0wQhszrJ4eCmebLVsDm
  B6AM3pPRygYo0REwxHbpTBAIt26zjGiKiFQqUjwa
  -----END CERTIFICATE-----
  
  -    listen_addr      => pki1001.eqiad.wmnet
  -    listen_port      => 8888
  -    default_auth_key => default_auth
  -    db_driver        => sqlite3
  -    db_user          => cfssl
  -    db_pass          => changeme
  -    ca_key_content   => nosecret
  
  -    db_host          => localhost
  -    manage_db        => False
  -    default_crl_url  => http://pki.discovery.wmnet/crl/cassandra
  -    serve_ensure     => absent
  -    default_ocsp_url => http://pki.discovery.wmnet/ocsp/cassandra
  -    ca_key_file      => /etc/cfssl/signers/cassandra/ca/cassandra-key.pem
  -    db_name          => cfssl
  -    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages   => ['digital signature', 'key encipherment', 'server auth', 'client auth']
  -    serve_service    => cfssl-multirootca
  

• File[/lib/systemd/system/prometheus-node-textfile-check-nft.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-check-nft.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-check-nft.service]
  
  +    notify => Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.service (prometheus-node-textfile-check-nft.service)]
  +    ensure => present
  +    owner  => root
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-check-nft.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-check-nft.service
  @@ -0,0 +1,8 @@
  +[Unit]
  +Description=Systemd timer to gather node metrics for check-nft
  +Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +
  +[Service]
  +Type=oneshot
  +User=root
  +ExecStart=/usr/local/bin/check-nft

• Systemd::Syslog[cfssl-ocsprefresh-syslog]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-syslog].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-syslog]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-wikikube_front_proxy-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_front_proxy_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_cassandra command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_cassandra
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "f5e260f525c48c963fb2e6c86a0d5d63" --timeout 10 --check-command "check_check_certificate_expiry_cassandra"

• Rsyslog::Conf[cfssl-ocsprefresh-syslog]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-syslog].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-syslog]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-syslog]
  -    ensure   => present
  -    mode     => 0444
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
  

• File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0400
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr.orig
  +++ /etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr
  @@ -1,13 +0,0 @@
  -{
  -  "CN": "pki1001.eqiad.wmnet",
  -  "hosts": [
  -    "pki1001.eqiad.wmnet"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -
  -  ]
  -}

• Systemd::Unit[wmf_auto_restart_ulogd2.timer]

  Parameters differences:

  --- Systemd::Unit[wmf_auto_restart_ulogd2.timer].orig
  +++ Systemd::Unit[wmf_auto_restart_ulogd2.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => wmf_auto_restart_ulogd2.timer
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
  
  -    ensure => present
  

• Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa -profile ocsp /etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse -profile ocsp /etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - cloud_wmnet_ca
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --responses-file /etc/cfssl/ocsp/cloud_wmnet_ca.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@cloud_wmnet_ca' cloud_wmnet_ca 

• File[/etc/cfssl/signers/aux_front_proxy/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/aux_front_proxy/ca].orig
  +++ File[/etc/cfssl/signers/aux_front_proxy/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Systemd::Timer[cfssl-ocsprefresh-kafka]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-kafka].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-kafka]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-kafka.service
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-discovery-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Systemd::Unit[cfssl-ocspserve@mlserve_front_proxy]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@mlserve_front_proxy].orig
  +++ Systemd::Unit[cfssl-ocspserve@mlserve_front_proxy]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@mlserve_front_proxy
  

• File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-puppet_rsa.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-puppet_rsa.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer
  @@ -1,12 +0,0 @@
  -[Unit]
  -Description=Periodic execution of prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
  -
  -[Timer]
  -Unit=prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnCalendar=daily
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_dse_4384c5ebc49e03dbe331e279fac3f393]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_dse_4384c5ebc49e03dbe331e279fac3f393].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_dse_4384c5ebc49e03dbe331e279fac3f393]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: dse
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="4384c5ebc49e03dbe331e279fac3f393",check_name="check_check_certificate_expiry_dse", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__dse
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: dse
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_dse))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• Rsyslog::Conf[cfssl-ocsprefresh-aux_front_proxy]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-aux_front_proxy].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-aux_front_proxy]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-aux_front_proxy]
  -    ensure   => present
  -    mode     => 0444
  

• Service[cfssl-ocsprefresh-wikikube.timer]

  Parameters differences:

  --- Service[cfssl-ocsprefresh-wikikube.timer].orig
  +++ Service[cfssl-ocsprefresh-wikikube.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Logrotate::Conf[cfssl-ocsprefresh-wikikube]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-wikikube].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-wikikube]
  
  -    ensure => present
  

• File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Rsyslog::Conf[cfssl-ocsprefresh-dse_front_proxy]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-dse_front_proxy].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-dse_front_proxy]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-dse_front_proxy]
  -    ensure   => present
  -    mode     => 0444
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_etcd.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_etcd.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_etcd.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem

• Systemd::Timer[nrpe2nodexp-ferm_active]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-ferm_active].orig
  +++ Systemd::Timer[nrpe2nodexp-ferm_active]
  
  -    fixed_random_delay => True
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 600
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '10min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-ferm_active.service
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery2026.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery2026.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery2026.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Systemd::Unit[cfssl-ocsprefresh-discovery.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-discovery.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-discovery.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-discovery.service
  

• File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft].orig
  +++ File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft.orig
  +++ /etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft
  @@ -0,0 +1,9 @@
  +# Autogenerated by puppet
  +set CLOUD_NETWORKS_PUBLIC_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2a02:ec80:a000:4000::/64,
  +             2a02:ec80:a100:4000::/64
  +    }
  +}

• Systemd::Service[cfssl-ocsprefresh-wikikube_front_proxy]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-wikikube_front_proxy].orig
  +++ Systemd::Service[cfssl-ocsprefresh-wikikube_front_proxy]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Unit[cfssl-ocspserve@aux_front_proxy]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@aux_front_proxy].orig
  +++ Systemd::Unit[cfssl-ocspserve@aux_front_proxy]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@aux_front_proxy
  

• Systemd::Unit[ferm-ferm-service-status-restart]

  Parameters differences:

  --- Systemd::Unit[ferm-ferm-service-status-restart].orig
  +++ Systemd::Unit[ferm-ferm-service-status-restart]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => ferm-service-status-restart
  -    ensure            => present
  -    override          => True
  -    source            => puppet:///modules/ferm/ferm_systemd_override
  -    restart           => False
  -    unit              => ferm
  

• Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux_front_proxy].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_aux_front_proxy command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "99cf4f8f014e8fd527800abcc213f494" --timeout 10 --check-command "check_check_certificate_expiry_aux_front_proxy"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_aux_front_proxy
  -    fixed_random_delay        => True
  -    ensure                    => absent
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 60
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Service[ferm]

  Parameters differences:

  --- Service[ferm].orig
  +++ Service[ferm]
  
  -    ensure  => running
  -    restart => /bin/systemctl reload-or-restart ferm
  

• Nrpe::Check[check_check_certificate_expiry_debmonitor]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_debmonitor].orig
  +++ Nrpe::Check[check_check_certificate_expiry_debmonitor]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
  -    before    => Monitoring::Service[check_certificate_expiry_debmonitor]
  -    ensure    => present
  -    sudo_user => root
  

• Systemd::Timer[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
  +++ Systemd::Timer[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
  -    unit_name          => prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
  

• File[/etc/nftables/input/10_ssh-from-bastion.nft]

  Parameters differences:

  --- File[/etc/nftables/input/10_ssh-from-bastion.nft].orig
  +++ File[/etc/nftables/input/10_ssh-from-bastion.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/input/10_ssh-from-bastion.nft.orig
  +++ /etc/nftables/input/10_ssh-from-bastion.nft
  @@ -0,0 +1,4 @@
  +# Managed by puppet
  +# 
  +ip saddr { 103.102.166.103, 185.15.58.6, 185.15.59.99, 195.200.68.99, 198.35.26.104, 208.80.153.110, 208.80.154.7 } tcp dport { 22 } accept
  +ip6 saddr { 2001:df2:e500:3:103:102:166:103, 2620:0:860:4:208:80:153:110, 2620:0:861:1:208:80:154:7, 2620:0:863:3:198:35:26:104, 2a02:ec80:300:3:185:15:59:99, 2a02:ec80:600:1:185:15:58:6, 2a02:ec80:700:3:195:200:68:99 } tcp dport { 22 } accept

• File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem]
  
  -    notify => Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
  -    owner  => root
  -    before => Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem.orig
  +++ /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDmzCCAvygAwIBAgIUN3uLiKCNVwnGG5H9qKGwTGT4fJowCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjEwMzI1MTQ1MTAwWhcNMjYwMzI0MTQ1MTAwWjCB
  -mTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  -GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxFzAVBgNVBAsTDkNsb3VkIFNlcnZp
  -Y2VzMTUwMwYDVQQDDCxXaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQV9vY3NwX3Np
  -Z25pbmdfY2VydDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLmGOcHNNTGsOVTG
  -17o/lTVCgVJqX751quqBZvJQUbAgfAv0PRgv6yjWzTmZnojzKHYRaV8NXhDIVBzo
  -l2DRWUOjggEbMIIBFzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUH
  -AwkwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQULRRzzcjqWQc2Fjci5s2v0FKSPJww
  -HwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBI
  -MEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dp
  -a2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6
  -Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
  -dF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgCI41DoiQFxqs9gDCZs4VhwcNeatHqe
  -98IqBIzFOMdZdkUnyTNiXf0VDkUYZ+n2mYmB5ZAaBTPYhTHgLNrc3KsmpQJCAfHM
  -Qr3AEz1MlZq2krL+7Mx9OuBQ3B/hXyC+met7EmKDziU8UyScxFfSIY1lwwgAmZHA
  -OEOWpgzuF4fGZFVf0dFi
  ------END CERTIFICATE-----

• File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem].orig
  +++ File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem.orig
  +++ /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
  @@ -1,23 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDvjCCAyCgAwIBAgIUV8ha2UdjViI49Xr/fZzbY4YPZdYwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
  -iTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  -GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
  -aW9uczEkMCIGA1UEAwwbbWxzZXJ2ZV9zdGFnaW5nX2Zyb250X3Byb3h5MIGbMBAG
  -ByqGSM49AgEGBSuBBAAjA4GGAAQAyrMiWBRjOWCaMXsvXC0wS6VzHyLLGFT8BpM9
  -EhYcloDfNnb8no2+YXrBzj4+lAg3D3dq53q+hyHko3+YsVVF/qABa55syWkYtxDB
  -xy5FNq6Iq/s2E3vO2YpQifWXlaSZvvuZCGhhTPDOp/zdI/kKdco9Jehsu6CdyElj
  -lCgJTZupZCmjggEMMIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB
  -/wIBATAdBgNVHQ4EFgQUj5l8xt65hr4t5yj8xKYmUsKwk9YwHwYDVR0jBBgwFoAU
  -O62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzAB
  -hjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRl
  -cm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292
  -ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjO
  -PQQDBAOBiwAwgYcCQgD24XA2cP2pFwE3onWEosbFqDEaFwD5kNg7eSOkncJIceFU
  -bCX1f6VOYSv6UbiEQV0EwS0d34EawydbLcqXqfHgpgJBJJjdNhpjAcwyRt1+unRc
  -dYn6ys1ZElRXMld7NUq+nCInX5cVk8uPeSev6IxIJc2eyBCb4jtjvE3TAQ2RHvT9
  -sBI=
  ------END CERTIFICATE-----

• File[/var/log/cfssl-ocsprefresh-mlserve_staging]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-mlserve_staging].orig
  +++ File[/var/log/cfssl-ocsprefresh-mlserve_staging]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-mlserve_front_proxy.timer
  

• File[/etc/cfssl/signers/discovery2026/ca/discovery2026.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/discovery2026/ca/discovery2026.pem].orig
  +++ File[/etc/cfssl/signers/discovery2026/ca/discovery2026.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/discovery2026/ca/discovery2026.pem.orig
  +++ /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDrzCCAxGgAwIBAgIUa46nWae1FhV+WZzdsRMJchzTP54wCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjYwNDIwMTUzNjAwWhcNMzEwNDE5MTUzNjAwWjB7
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRYwFAYDVQQDEw1kaXNjb3ZlcnkyMDI2MIGbMBAGByqGSM49AgEGBSuBBAAj
  -A4GGAAQBNeE+xxvbq00KO92aWhHFTLosZBkXul9ufZINtOUd90TXpQnJvpEv7kK8
  -HQpufac9Dez+MBhLzQXoTY+ElhRCsQQBwlu+rIeqpbJEh87DQ2RTfzhTJmlm/9de
  -1fiM38/51DacwYS/vW0psN/lKSoM7cX/Paw6Qg7pBUmUGCq2vE9wDbmjggEMMIIB
  -CDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU
  -SXZcMeXrgnEYbZ3z1m8j/+8XmugwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR
  -0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRp
  -c2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoG
  -A1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9X
  -aWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQgD4
  -UGn506FGvacDvYS6t8JEMo6YH7jxK8dKeiZNEnhG5FSjA4Lt2BCz85sOBczxSD9h
  -b9wLCxy5wOpifRePlyrZQgJBNKUXBImWpyoHmt6hNOA6X7+FmGl0tD5tLnbeuPx7
  -aTlv8rfJ0d7JdsZXx+7M6YcsmxMgZCKUh4UMYu/WcczIq30=
  ------END CERTIFICATE-----

• Systemd::Unit[cfssl-ocsprefresh-etcd.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-etcd.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-etcd.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-etcd.timer
  

• File[/etc/apache2/mods-enabled/status.conf]

  Parameters differences:

  --- File[/etc/apache2/mods-enabled/status.conf].orig
  +++ File[/etc/apache2/mods-enabled/status.conf]
  
  -    require => Package[apache2]
  -    ensure  => absent
  -    owner   => root
  -    before  => Httpd::Mod_conf[status]
  -    group   => root
  

• Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - wikikube_front_proxy
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --responses-file /etc/cfssl/ocsp/wikikube_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_front_proxy' wikikube_front_proxy 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-mlserve_staging_front_proxy.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-mlserve_staging_front_proxy.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Sudo::User[nrpe-check_check_certificate_expiry_zuul]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_zuul].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_zuul]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem']
  -    tag        => nrpe::check
  

• Class[Ulogd]

  Parameters differences:

  --- Class[Ulogd].orig
  +++ Class[Ulogd]
  
  -    log_level           => info
  -    json_logfile        => /var/log/ulog/ulogd.json
  -    nacct_file          => /var/log/ulog/nacct.log
  -    sync                => True
  -    logfile             => syslog
  -    oprint_logfile      => /var/log/ulog/oprint.log
  -    nflog               => ['SYSLOG']
  -    nfct                => []
  -    config_file         => /etc/ulogd.conf
  -    syslog_facility     => local7
  -    logemu_nfct_logfile => /var/log/ulog/syslogemu_nfct.log
  -    ensure              => present
  -    gprint_logfile      => /var/log/ulog/gprint.log
  -    xml_directory       => /var/log/ulog/
  -    pcap_file           => /var/log/ulog/ulogd.pcap
  -    syslog_level        => info
  -    json_nfct_logfile   => /var/log/ulog/ulogd_nfct.json
  -    logemu_logfile      => /var/log/ulog/syslogemu.log
  -    acct                => []
  

• Class[Profile::Apt]

  Parameters differences:

  --- Class[Profile::Apt].orig
  +++ Class[Profile::Apt]
  
  @@
  -    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[quickstack]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[atop]', 'Package[libpython2.7]', 'Package[libpython2.7-dev]', 'Package[libpython2.7-minimal]', 'Package[python2.7]', 'Package[libpython2.7-stdlib]', 'Package[python2.7-dev]', 'Package[python2.7-minimal]', 'Package[python2.7-dbg]', 'Package[python2.7-doc]', 'Package[python2.7-examples]', 'Package[libpython2.7-testsuite]', 'Package[intel-microcode]', 'Package[rasdaemon]', 'Package[libsnmp30]', 'Package[libdns-export1104]', 'Package[libdns1104]', 'Package[libisc-export1100]', 'Package[libisc1100]', 'Package[multiarch-support]', 'Package[libjson-c3]', 'Package[libpython3.7]', 'Package[libpython3.7-minimal]', 'Package[libpython3.7-stdlib]', 'Package[python3.7]', 'Package[python3.7-minimal]', 'Package[libevent-2.1-6]', 'Package[libwireshark11]', 'Package[libwiretap8]', 'Package[libwsutil9]', 'Package[libwscodecs2]', 'Package[libperl5.28]', 'Package[libmpdec2]', 'Package[perl-modules-5.28]', 'Package[libhogweed4]', 'Package[libnettle6]', 'Package[libprocps7]', 'Package[libip6tc0]', 'Package[libip4tc0]', 'Package[libiptc0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[apache2]', 'Package[links]', 'Package[ruby-sys-filesystem]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[python3-pymysql]', 'Package[python3-cryptography]']
  +    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[quickstack]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[atop]', 'Package[libpython2.7]', 'Package[libpython2.7-dev]', 'Package[libpython2.7-minimal]', 'Package[python2.7]', 'Package[libpython2.7-stdlib]', 'Package[python2.7-dev]', 'Package[python2.7-minimal]', 'Package[python2.7-dbg]', 'Package[python2.7-doc]', 'Package[python2.7-examples]', 'Package[libpython2.7-testsuite]', 'Package[intel-microcode]', 'Package[rasdaemon]', 'Package[libsnmp30]', 'Package[libdns-export1104]', 'Package[libdns1104]', 'Package[libisc-export1100]', 'Package[libisc1100]', 'Package[multiarch-support]', 'Package[libjson-c3]', 'Package[libpython3.7]', 'Package[libpython3.7-minimal]', 'Package[libpython3.7-stdlib]', 'Package[python3.7]', 'Package[python3.7-minimal]', 'Package[libevent-2.1-6]', 'Package[libwireshark11]', 'Package[libwiretap8]', 'Package[libwsutil9]', 'Package[libwscodecs2]', 'Package[libperl5.28]', 'Package[libmpdec2]', 'Package[perl-modules-5.28]', 'Package[libhogweed4]', 'Package[libnettle6]', 'Package[libprocps7]', 'Package[libip6tc0]', 'Package[libip4tc0]', 'Package[libiptc0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[ruby-sys-filesystem]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']
  

• Ferm::Service[csr_and_ocsp_responder]

  Parameters differences:

  --- Ferm::Service[csr_and_ocsp_responder].orig
  +++ Ferm::Service[csr_and_ocsp_responder]
  
  -    ensure              => present
  -    port                => 80
  -    prio                => 10
  -    desc                => 
  -    src_sets            => ['DOMAIN_NETWORKS', 'MGMT_NETWORKS']
  -    proto               => tcp
  -    unrestricted_access => False
  -    notrack             => False
  

• Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label debmonitor -profile ocsp /etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/cfssl/signers/wikikube/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/wikikube/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/wikikube/cfssl.conf.orig
  +++ /etc/cfssl/signers/wikikube/cfssl.conf
  @@ -1,81 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "signing",
  -        "key encipherment",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/wikikube",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/wikikube"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "service-account-management": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment"
  -        ]
  -      },
  -      "prometheus": {
  -        "auth_key": "default_auth",
  -        "expiry": "8760h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "client auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-dse_front_proxy-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --outfile /var/lib/prometheus/node.d/dse_front_proxy_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery -profile ocsp /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/cfssl/db.conf.json]

  Parameters differences:

  --- File[/etc/cfssl/db.conf.json].orig
  +++ File[/etc/cfssl/db.conf.json]
  
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/db.conf.json.orig
  +++ /etc/cfssl/db.conf.json
  @@ -1,12 +0,0 @@
  -{
  -  "host": "m1-master.eqiad.wmnet",
  -  "port": 3306,
  -  "user": "pki",
  -  "password": "changeme",
  -  "db": "pki",
  -  "charset": "utf8mb4",
  -  "ssl": {
  -    "ca": "/etc/ssl/certs/wmf-ca-certificates.crt",
  -    "check_hostname": false
  -  }
  -}

• Logrotate::Conf[cfssl-ocsprefresh-etcd]

  Parameters differences:

  --- Logrotate::Conf[cfssl-ocsprefresh-etcd].orig
  +++ Logrotate::Conf[cfssl-ocsprefresh-etcd]
  
  -    ensure => present
  

• Service[cfssl-ocspserve@cloud_wmnet_ca]

  Parameters differences:

  --- Service[cfssl-ocspserve@cloud_wmnet_ca].orig
  +++ Service[cfssl-ocspserve@cloud_wmnet_ca]
  
  -    ensure => running
  -    enable => True
  

• Sudo::User[nrpe-check_check_certificate_expiry_dse_front_proxy]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_dse_front_proxy].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_dse_front_proxy]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem']
  -    tag        => nrpe::check
  

• File[/etc/nftables/output]

  Parameters differences:

  --- File[/etc/nftables/output].orig
  +++ File[/etc/nftables/output]
  
  +    ensure  => directory
  +    purge   => True
  +    recurse => True
  +    owner   => root
  +    group   => root
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-discovery2026" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-discovery2026/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Systemd::Unit[cfssl-ocspserve@wikikube_front_proxy]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@wikikube_front_proxy].orig
  +++ Systemd::Unit[cfssl-ocspserve@wikikube_front_proxy]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@wikikube_front_proxy
  

• Nftables::Set[KAFKA_BROKERS_JUMBO]

  Parameters differences:

  --- Nftables::Set[KAFKA_BROKERS_JUMBO].orig
  +++ Nftables::Set[KAFKA_BROKERS_JUMBO]
  
  +    hosts  => ['10.64.130.10', '2620:0:861:109:10:64:130:10', '10.64.131.16', '2620:0:861:10a:10:64:131:16', '10.64.132.21', '2620:0:861:10b:10:64:132:21', '10.64.134.9', '2620:0:861:10d:10:64:134:9', '10.64.135.16', '2620:0:861:10e:10:64:135:16', '10.64.136.11', '2620:0:861:10f:10:64:136:11', '10.64.154.15', '2620:0:861:122:10:64:154:15', '10.64.160.16', '2620:0:861:128:10:64:160:16', '10.64.0.126', '2620:0:861:101:10:64:0:126']
  +    ensure => present
  

• Nrpe::Monitor_service[check_certificate_expiry_aux]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_aux].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_aux]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: aux
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem
  -    timeout                     => 10
  

• Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-puppet_rsa.service
  

• Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-mlserve_staging]
  -    ensure   => present
  -    mode     => 0444
  

• File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft
  @@ -0,0 +1,9 @@
  +# Autogenerated by puppet
  +set MLSERVE_KUBEPODS_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2620:0:861:300::/64,
  +             2620:0:860:300::/64
  +    }
  +}

• File[/etc/sudoers.d/nrpe_certificate_check_wikikube]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_wikikube].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_wikikube]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Motd::Message[insetup::infrastructure_foundations_nftables]

  Parameters differences:

  --- Motd::Message[insetup::infrastructure_foundations_nftables].orig
  +++ Motd::Message[insetup::infrastructure_foundations_nftables]
  
  +    priority => 5
  +    message  => pki1001 is a Host being setup by Infrastructure Foundations SREs with ntables (insetup::infrastructure_foundations_nftables)
  +    ensure   => present
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Firewall::Service[csr_and_ocsp_responder]

  Parameters differences:

  --- Firewall::Service[csr_and_ocsp_responder].orig
  +++ Firewall::Service[csr_and_ocsp_responder]
  
  -    ensure              => present
  -    port                => 80
  -    prio                => 10
  -    desc                => 
  -    src_sets            => ['DOMAIN_NETWORKS', 'MGMT_NETWORKS']
  -    proto               => tcp
  -    unrestricted_access => False
  -    notrack             => False
  

• Exec[renew certificate - OCSP_syslog_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_syslog_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_syslog_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label syslog -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Profile::Pki::Multirootca::Monitoring[puppet_rsa]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[puppet_rsa].orig
  +++ Profile::Pki::Multirootca::Monitoring[puppet_rsa]
  
  -    intermediate => puppet_rsa
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
  

• Cfssl::Config[mlserve_staging]

  Parameters differences:

  --- Cfssl::Config[mlserve_staging].orig
  +++ Cfssl::Config[mlserve_staging]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/mlserve_staging/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 72h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/mlserve_staging
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/mlserve_staging
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
  -    default_usages      => ['signing', 'key encipherment', 'client auth']
  

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
  
  -    ensure => present
  

• Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - wikikube_staging
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --responses-file /etc/cfssl/ocsp/wikikube_staging.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_staging' wikikube_staging 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/nftables/sets/CUMIN_MASTERS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/CUMIN_MASTERS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/CUMIN_MASTERS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/CUMIN_MASTERS_ipv6.nft.orig
  +++ /etc/nftables/sets/CUMIN_MASTERS_ipv6.nft
  @@ -0,0 +1,7 @@
  +# Autogenerated by puppet
  +set CUMIN_MASTERS_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:102:10:64:16:154,
  +             2620:0:860:103:10:192:32:49
  +    }
  +}

• Systemd::Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Monitoring::Service[ferm_active]

  Parameters differences:

  --- Monitoring::Service[ferm_active].orig
  +++ Monitoring::Service[ferm_active]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 30
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/check_ferm
  -    passive        => False
  -    description    => Check whether ferm is active by checking the default input chain
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_ferm_active!10
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-mlserve_front_proxy-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_front_proxy_intermediate.prom

• File[/etc/update-motd.d/05-pki--multirootca]

  Parameters differences:

  --- File[/etc/update-motd.d/05-pki--multirootca].orig
  +++ File[/etc/update-motd.d/05-pki--multirootca]
  
  -    ensure => present
  -    mode   => 0555
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/update-motd.d/05-pki--multirootca.orig
  +++ /etc/update-motd.d/05-pki--multirootca
  @@ -1,2 +0,0 @@
  -#!/bin/sh
  -printf "%s\n" "pki1001 is a PKI server (pki::multirootca)"

• Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer].orig
  +++ Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]']
  

• File[/etc/nftables/sets/LINK_LOCAL_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/LINK_LOCAL_ipv4.nft].orig
  +++ File[/etc/nftables/sets/LINK_LOCAL_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/LINK_LOCAL_ipv4.nft.orig
  +++ /etc/nftables/sets/LINK_LOCAL_ipv4.nft
  @@ -0,0 +1,8 @@
  +# Autogenerated by puppet
  +set LINK_LOCAL_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 169.254.0.0/16
  +    }
  +}

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: wikikube
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_wikikube!10
  

• Systemd::Service[wmf_auto_restart_apache-htcacheclean]

  Parameters differences:

  --- Systemd::Service[wmf_auto_restart_apache-htcacheclean].orig
  +++ Systemd::Service[wmf_auto_restart_apache-htcacheclean]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft.orig
  +++ /etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft
  @@ -0,0 +1,13 @@
  +# Autogenerated by puppet
  +set SANDBOX_NETWORKS_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2001:df2:e500:202::/64,
  +             2620:0:860:201::/64,
  +             2620:0:861:202::/64,
  +             2620:0:863:201::/64,
  +             2a02:ec80:300:202::/64,
  +             2a02:ec80:700:201::/64
  +    }
  +}

• File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Exec[renew certificate - OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• Exec[Generate initial CRL for aux]

  Parameters differences:

  --- Exec[Generate initial CRL for aux].orig
  +++ Exec[Generate initial CRL for aux]
  
  -    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/aux/ca/aux.pem /etc/cfssl/signers/aux/ca/aux-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/aux
  -    path    => ['/usr/bin']
  -    require => ['Package[golang-cfssl]']
  -    creates => /srv/cfssl/crl/aux
  

• Nrpe::Check[check_check_certificate_expiry_cloud_wmnet_ca]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_cloud_wmnet_ca].orig
  +++ Nrpe::Check[check_check_certificate_expiry_cloud_wmnet_ca]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
  -    before    => Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca]
  -    ensure    => present
  -    sudo_user => root
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem

• Systemd::Timer[wmf_auto_restart_ulogd2]

  Parameters differences:

  --- Systemd::Timer[wmf_auto_restart_ulogd2].orig
  +++ Systemd::Timer[wmf_auto_restart_ulogd2]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 5:37:00'}]
  -    unit_name          => wmf_auto_restart_ulogd2.service
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
  

• Cfssl::Cert[OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => wikikube_staging_front_proxy
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@wikikube_staging_front_proxy]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• File[/etc/rsyslog.d/40-wmf-auto-restart-apache2.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-wmf-auto-restart-apache2.conf].orig
  +++ File[/etc/rsyslog.d/40-wmf-auto-restart-apache2.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-wmf-auto-restart-apache2.conf.orig
  +++ /etc/rsyslog.d/40-wmf-auto-restart-apache2.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "wmf_auto_restart_apache2" then {
  -    action(
  -        type="omfile" file="/var/log/wmf_auto_restart_apache2/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/etc/ferm/functions.conf]

  Parameters differences:

  --- File[/etc/ferm/functions.conf].orig
  +++ File[/etc/ferm/functions.conf]
  
  -    notify  => Service[ferm]
  -    require => Package[ferm]
  -    ensure  => file
  -    owner   => root
  -    source  => puppet:///modules/ferm/functions.conf
  -    mode    => 0400
  -    group   => root
  

• Concat::Fragment[main]

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - Wikimedia_Internal_Root_CA
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem --responses-file /etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@Wikimedia_Internal_Root_CA' Wikimedia_Internal_Root_CA 

• Service[cfssl-ocspserve@wikikube_front_proxy]

  Parameters differences:

  --- Service[cfssl-ocspserve@wikikube_front_proxy].orig
  +++ Service[cfssl-ocspserve@wikikube_front_proxy]
  
  -    ensure => running
  -    enable => True
  

• Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-mlserve_staging_front_proxy.service
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-aux" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-aux/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• File[/etc/logrotate.d/cfssl-ocsprefresh-etcd]

  Parameters differences:

  --- File[/etc/logrotate.d/cfssl-ocsprefresh-etcd].orig
  +++ File[/etc/logrotate.d/cfssl-ocsprefresh-etcd]
  
  -    ensure => present
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/cfssl-ocsprefresh-etcd.orig
  +++ /etc/logrotate.d/cfssl-ocsprefresh-etcd
  @@ -1,12 +0,0 @@
  -# logrotate(8) config for cfssl-ocsprefresh-etcd
  -
  -/var/log/cfssl-ocsprefresh-etcd/*.log {
  -    daily
  -    copytruncate
  -    missingok
  -    compress
  -    delaycompress
  -    notifempty
  -    rotate 15
  -    size 256M
  -}

• File[/etc/rsyslog.d/40-ulogd.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-ulogd.conf].orig
  +++ File[/etc/rsyslog.d/40-ulogd.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-ulogd.conf.orig
  +++ /etc/rsyslog.d/40-ulogd.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "ulogd" then {
  -    action(
  -        type="omfile" file="/var/log/ulogd/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0600"
  -    )
  -    & stop
  -}

• Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - mlserve_staging_front_proxy
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --responses-file /etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_staging_front_proxy' mlserve_staging_front_proxy 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Class[Monitoring]

  Parameters differences:

  --- Class[Monitoring].orig
  +++ Class[Monitoring]
  
  @@
  -    cluster               => pki
  +    cluster               => insetup
  @@
  -    notifications_enabled => True
  +    notifications_enabled => False
  @@
  -    nagios_group          => pki_eqiad
  +    nagios_group          => insetup_eqiad
  

• Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-wikikube_front_proxy.timer
  

• File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Service[wmf_auto_restart_apache2]

  Parameters differences:

  --- Systemd::Service[wmf_auto_restart_apache2].orig
  +++ Systemd::Service[wmf_auto_restart_apache2]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[wmf_auto_restart_apache2.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/nftables/sets/CACHES_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/CACHES_ipv6.nft].orig
  +++ File[/etc/nftables/sets/CACHES_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/CACHES_ipv6.nft.orig
  +++ /etc/nftables/sets/CACHES_ipv6.nft
  @@ -0,0 +1,117 @@
  +# Autogenerated by puppet
  +set CACHES_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:101:10:64:0:79,
  +             2620:0:861:101:10:64:0:229,
  +             2620:0:861:101:10:64:0:14,
  +             2620:0:861:101:10:64:0:51,
  +             2620:0:861:102:10:64:16:241,
  +             2620:0:861:102:10:64:16:94,
  +             2620:0:861:102:10:64:16:95,
  +             2620:0:861:102:10:64:16:240,
  +             2620:0:861:103:10:64:32:14,
  +             2620:0:861:103:10:64:32:60,
  +             2620:0:861:103:10:64:32:15,
  +             2620:0:861:103:10:64:32:65,
  +             2620:0:861:107:10:64:48:16,
  +             2620:0:861:107:10:64:48:41,
  +             2620:0:861:107:10:64:48:27,
  +             2620:0:861:107:10:64:48:28,
  +             2620:0:860:113:10:192:23:26,
  +             2620:0:860:107:10:192:6:20,
  +             2620:0:860:10d:10:192:12:35,
  +             2620:0:860:10f:10:192:14:25,
  +             2620:0:860:100:10:192:4:22,
  +             2620:0:860:116:10:192:29:26,
  +             2620:0:860:119:10:192:30:29,
  +             2620:0:860:11b:10:192:36:19,
  +             2620:0:860:11f:10:192:40:25,
  +             2620:0:860:120:10:192:41:21,
  +             2620:0:860:12b:10:192:56:3,
  +             2620:0:860:12b:10:192:56:4,
  +             2620:0:860:12c:10:192:57:3,
  +             2620:0:860:12d:10:192:58:2,
  +             2620:0:860:12d:10:192:58:3,
  +             2620:0:860:12e:10:192:59:2,
  +             2a02:ec80:300:101:10:80:0:14,
  +             2a02:ec80:300:102:10:80:1:11,
  +             2a02:ec80:300:101:10:80:0:13,
  +             2a02:ec80:300:102:10:80:1:9,
  +             2a02:ec80:300:101:10:80:0:12,
  +             2a02:ec80:300:102:10:80:1:7,
  +             2a02:ec80:300:101:10:80:0:11,
  +             2a02:ec80:300:102:10:80:1:6,
  +             2a02:ec80:300:101:10:80:0:10,
  +             2a02:ec80:300:102:10:80:1:5,
  +             2a02:ec80:300:101:10:80:0:8,
  +             2a02:ec80:300:102:10:80:1:4,
  +             2a02:ec80:300:101:10:80:0:7,
  +             2a02:ec80:300:102:10:80:1:3,
  +             2a02:ec80:300:101:10:80:0:6,
  +             2a02:ec80:300:102:10:80:1:2,
  +             2620:0:863:101:10:128:0:19,
  +             2620:0:863:101:10:128:0:27,
  +             2620:0:863:101:10:128:0:22,
  +             2620:0:863:101:10:128:0:28,
  +             2620:0:863:101:10:128:0:25,
  +             2620:0:863:101:10:128:0:29,
  +             2620:0:863:101:10:128:0:26,
  +             2620:0:863:101:10:128:0:31,
  +             2620:0:863:101:10:128:0:14,
  +             2620:0:863:101:10:128:0:35,
  +             2620:0:863:101:10:128:0:21,
  +             2620:0:863:101:10:128:0:36,
  +             2620:0:863:101:10:128:0:24,
  +             2620:0:863:101:10:128:0:10,
  +             2620:0:863:101:10:128:0:37,
  +             2620:0:863:101:10:128:0:12,
  +             2001:df2:e500:101:10:132:0:17,
  +             2001:df2:e500:101:10:132:0:18,
  +             2001:df2:e500:101:10:132:0:19,
  +             2001:df2:e500:101:10:132:0:24,
  +             2001:df2:e500:101:10:132:0:29,
  +             2001:df2:e500:101:10:132:0:30,
  +             2001:df2:e500:101:10:132:0:34,
  +             2001:df2:e500:101:10:132:0:35,
  +             2001:df2:e500:101:10:132:0:36,
  +             2001:df2:e500:101:10:132:0:37,
  +             2001:df2:e500:101:10:132:0:38,
  +             2001:df2:e500:101:10:132:0:25,
  +             2001:df2:e500:101:10:132:0:26,
  +             2001:df2:e500:101:10:132:0:27,
  +             2001:df2:e500:101:10:132:0:28,
  +             2001:df2:e500:101:10:132:0:16,
  +             2a02:ec80:600:101:10:136:0:6,
  +             2a02:ec80:600:102:10:136:1:6,
  +             2a02:ec80:600:101:10:136:0:7,
  +             2a02:ec80:600:102:10:136:1:7,
  +             2a02:ec80:600:101:10:136:0:8,
  +             2a02:ec80:600:102:10:136:1:8,
  +             2a02:ec80:600:101:10:136:0:9,
  +             2a02:ec80:600:102:10:136:1:9,
  +             2a02:ec80:600:101:10:136:0:10,
  +             2a02:ec80:600:102:10:136:1:10,
  +             2a02:ec80:600:101:10:136:0:11,
  +             2a02:ec80:600:102:10:136:1:11,
  +             2a02:ec80:600:101:10:136:0:12,
  +             2a02:ec80:600:102:10:136:1:12,
  +             2a02:ec80:600:101:10:136:0:13,
  +             2a02:ec80:600:102:10:136:1:13,
  +             2a02:ec80:700:101:10:140:0:3,
  +             2a02:ec80:700:102:10:140:1:4,
  +             2a02:ec80:700:101:10:140:0:4,
  +             2a02:ec80:700:102:10:140:1:5,
  +             2a02:ec80:700:101:10:140:0:5,
  +             2a02:ec80:700:102:10:140:1:6,
  +             2a02:ec80:700:101:10:140:0:6,
  +             2a02:ec80:700:102:10:140:1:7,
  +             2a02:ec80:700:101:10:140:0:7,
  +             2a02:ec80:700:102:10:140:1:8,
  +             2a02:ec80:700:101:10:140:0:8,
  +             2a02:ec80:700:102:10:140:1:9,
  +             2a02:ec80:700:101:10:140:0:9,
  +             2a02:ec80:700:102:10:140:1:10,
  +             2a02:ec80:700:101:10:140:0:10,
  +             2a02:ec80:700:102:10:140:1:11
  +    }
  +}

• Cfssl::Cert[OCSP_mlserve_staging_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_mlserve_staging_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_mlserve_staging_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => mlserve_staging
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@mlserve_staging]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_mlserve.timer
  

• File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/MGMT_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/MGMT_NETWORKS_ipv4.nft
  @@ -0,0 +1,14 @@
  +# Autogenerated by puppet
  +set MGMT_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 10.65.0.0/16,
  +             10.128.128.0/17,
  +             10.193.0.0/16,
  +             10.80.128.0/17,
  +             10.132.128.0/17,
  +             10.136.128.0/17,
  +             10.140.128.0/17
  +    }
  +}

• Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/confd/conf.d/_etc_ferm_conf.d_00_defs_requestctl.toml]

  Parameters differences:

  --- File[/etc/confd/conf.d/_etc_ferm_conf.d_00_defs_requestctl.toml].orig
  +++ File[/etc/confd/conf.d/_etc_ferm_conf.d_00_defs_requestctl.toml]
  
  @@
  -    ensure => present
  +    ensure => absent
  

• Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS]

  Parameters differences:

  --- Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS].orig
  +++ Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS]
  
  +    hosts  => ['10.194.61.0/24', '2620:0:860:302::/64']
  +    ensure => present
  

• File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-ocsprefresh-syslog" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-ocsprefresh-syslog/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Systemd::Unit[cfssl-ocspserve@cloud_wmnet_ca]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocspserve@cloud_wmnet_ca].orig
  +++ Systemd::Unit[cfssl-ocspserve@cloud_wmnet_ca]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-ocspserve@cloud_wmnet_ca
  

• Systemd::Timer[cfssl-ocsprefresh-aux_front_proxy]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-aux_front_proxy].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-aux_front_proxy]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-aux_front_proxy.service
  

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-syslog-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-syslog-certificate-expiry --cert-path /etc/cfssl/signers/syslog/ca/syslog.pem --outfile /var/lib/prometheus/node.d/syslog_intermediate.prom

• File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem].orig
  +++ File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem]
  
  -    notify => Service[cfssl-multirootca]
  -    ensure => file
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem.orig
  +++ /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
  @@ -1,23 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDwDCCAyGgAwIBAgIUJT4TJHFy4qcc2DDVjG00p9VDOcIwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
  -ijELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
  -GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
  -aW9uczElMCMGA1UEAwwcd2lraWt1YmVfc3RhZ2luZ19mcm9udF9wcm94eTCBmzAQ
  -BgcqhkjOPQIBBgUrgQQAIwOBhgAEAQkWDUaTmBFtrLcFLkOP5LV+kGQdr0TIYAMX
  -FR7UbUmysish4+UlH7C2vcugX/XmmIoh2asGRkfb0kjTQUUjqDmmANYQARMmx/V4
  -j87yMi11K3IxBh2Ei7KJzvXD5yhg/rQa1TVcdvZ1GHBL1QvBU5x2L95G+Exi1amQ
  -dC4vktygtdo8o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB
  -Af8CAQEwHQYDVR0OBBYEFANI4okfmz36Vpe1jEq4tkgKl5HzMB8GA1UdIwQYMBaA
  -FDutonHmNL0b/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcw
  -AYY6aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50
  -ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2Nv
  -dmVyeS53bW5ldC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZI
  -zj0EAwQDgYwAMIGIAkIBuKBFQ/g6puAs+HK7+bE4eiatpN7eotPUTNbVuxN4+rEO
  -E6JEpXslb/Ad0rVDvEOmXGSH9EdqjCNJs0Qv5kFnqZQCQgCPyFWGoBUxDcWLjOEL
  -2a1pt4joI2BUut3NtLOBgPeaI/5qqPoLFbxn/1DMBmZLlsoNhnrg99F5LgvQVEAA
  -/3y5tw==
  ------END CERTIFICATE-----

• File[/etc/cfssl/signers/zuul/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/zuul/ca].orig
  +++ File[/etc/cfssl/signers/zuul/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-aux_front_proxy.timer]']
  -    refreshonly => True
  

• Class[Profile::Cumin::Target]

  Parameters differences:

  --- Class[Profile::Cumin::Target].orig
  +++ Class[Profile::Cumin::Target]
  
  @@
  -    cluster => pki
  +    cluster => insetup
  

• File[/srv/cfssl/bundles]

  Parameters differences:

  --- File[/srv/cfssl/bundles].orig
  +++ File[/srv/cfssl/bundles]
  
  -    ensure => directory
  -    group  => root
  -    owner  => root
  

• Exec[renew certificate - OCSP_wikikube_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_wikikube_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_wikikube_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca].orig
  +++ Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_cloud_wmnet_ca!10
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-network_devices.timer]']
  -    refreshonly => True
  

• Nrpe::Monitor_service[check_certificate_expiry_cloud_wmnet_ca]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_cloud_wmnet_ca].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_cloud_wmnet_ca]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
  -    timeout                     => 10
  

• File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft.orig
  +++ /etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft
  @@ -0,0 +1,11 @@
  +# Autogenerated by puppet
  +set ZOOKEEPER_FLINK_HOSTS_ipv4 {
  +    type ipv4_addr
  +    elements = { 10.64.16.9,
  +             10.64.0.8,
  +             10.64.32.41,
  +             10.192.16.227,
  +             10.192.32.179,
  +             10.192.48.219
  +    }
  +}

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-aux_front_proxy-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --outfile /var/lib/prometheus/node.d/aux_front_proxy_intermediate.prom

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem

• Cfssl::Cert[OCSP_discovery_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Cfssl::Cert[OCSP_discovery_pki1001_eqiad_wmnet].orig
  +++ Cfssl::Cert[OCSP_discovery_pki1001_eqiad_wmnet]
  
  -    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
  -    provide_chain   => False
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    owner           => root
  -    renew_seconds   => 952200
  -    notify_services => []
  -    group           => root
  -    label           => discovery
  -    before_services => []
  -    notify          => Service[cfssl-ocspserve@discovery]
  -    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
  -    names           => []
  -    ensure          => present
  -    common_name     => pki1001.eqiad.wmnet
  -    before          => Systemd::Timer::Job[cfssl-ocsprefresh-discovery]
  -    mode            => 0740
  -    outdir          => /etc/cfssl/ssl/ocsp
  -    auto_renew      => True
  -    profile         => ocsp
  -    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
  -    hosts           => []
  -    key             => {'algo': 'ecdsa', 'size': 256}
  

• File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
  +++ File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• File[/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/mlserve_front_proxy/cfssl.conf.orig
  +++ /etc/cfssl/signers/mlserve_front_proxy/cfssl.conf
  @@ -1,64 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "signing",
  -        "key encipherment",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/mlserve_front_proxy",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/mlserve_front_proxy"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]
  
  -    names       => []
  -    ensure      => present
  -    common_name => pki1001.eqiad.wmnet
  -    hosts       => []
  -    key         => {'algo': 'ecdsa', 'size': 256}
  

• Prometheus::Alert::Rule[check_check_certificate_expiry_cassandra_f5e260f525c48c963fb2e6c86a0d5d63]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_cassandra_f5e260f525c48c963fb2e6c86a0d5d63].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_cassandra_f5e260f525c48c963fb2e6c86a0d5d63]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: cassandra
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="f5e260f525c48c963fb2e6c86a0d5d63",check_name="check_check_certificate_expiry_cassandra", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__cassandra
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: cassandra
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_cassandra))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• File[/etc/cfssl/signers/aux/ca/aux-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/aux/ca/aux-key.pem].orig
  +++ File[/etc/cfssl/signers/aux/ca/aux-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/aux/ca/aux-key.pem.orig
  +++ /etc/cfssl/signers/aux/ca/aux-key.pem
  @@ -1 +0,0 @@
  -nosecret

• Systemd::Service[nrpe2nodexp-check_cfssl-multirootca_status]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_cfssl-multirootca_status].orig
  +++ Systemd::Service[nrpe2nodexp-check_cfssl-multirootca_status]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft.orig
  +++ /etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft
  @@ -0,0 +1,9 @@
  +# Autogenerated by puppet
  +set PROMETHEUS_HOSTS_ipv4 {
  +    type ipv4_addr
  +    elements = { 10.64.0.82,
  +             10.64.16.62,
  +             10.64.48.171,
  +             10.64.32.85
  +    }
  +}

• File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-mlserve_front_proxy.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-mlserve_front_proxy.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Sudo::User[nrpe-check_check_certificate_expiry_dse]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_dse].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_dse]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem']
  -    tag        => nrpe::check
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-network_devices-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-network_devices-certificate-expiry --cert-path /etc/cfssl/signers/network_devices/ca/network_devices.pem --outfile /var/lib/prometheus/node.d/network_devices_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg]
  
  -    notify  => Service[nagios-nrpe-server]
  -    require => Package[nagios-nrpe-server]
  -    ensure  => present
  -    owner   => root
  -    tag     => nrpe::check
  -    mode    => 0444
  -    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg
  @@ -1,2 +0,0 @@
  -# File generated by puppet. DO NOT edit by hand
  -command[check_check_certificate_expiry_dse_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem

• Prometheus::Alert::Rule[check_check_certificate_expiry_network_devices_21dac3775d059b8c991626e2ca33f951]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_certificate_expiry_network_devices_21dac3775d059b8c991626e2ca33f951].orig
  +++ Prometheus::Alert::Rule[check_check_certificate_expiry_network_devices_21dac3775d059b8c991626e2ca33f951]
  
  -    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: network_devices
  -    expr               => (nagios_nrpe_check_result{alert_rule_hash="21dac3775d059b8c991626e2ca33f951",check_name="check_check_certificate_expiry_network_devices", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  -    def_label_whitelst => ['team', 'severity']
  -    ensure             => absent
  -    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__network_devices
  -    instance           => ops
  -    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: network_devices
  -    dashboard          => TODO
  -    site               => eqiad
  -    severity           => info
  -    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_network_devices))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  -    team               => observability
  -    for                => 3m
  -    group              => nrpechecks
  

• File_line[auto_restart_file_presence_apache-htcacheclean]

  Parameters differences:

  --- File_line[auto_restart_file_presence_apache-htcacheclean].orig
  +++ File_line[auto_restart_file_presence_apache-htcacheclean]
  
  -    require => File[/etc/debdeploy-client/autorestarts.conf]
  -    path    => /etc/debdeploy-client/autorestarts.conf
  -    ensure  => absent
  -    line    => apache-htcacheclean
  

• Systemd::Unit[cfssl-ocsprefresh-kafka.timer]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-kafka.timer].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-kafka.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-kafka.timer
  

• Prometheus::Blackbox::Check::Http[PKI_aux_front_proxy]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_aux_front_proxy].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_aux_front_proxy]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"aux_front_proxy"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Monitoring::Service[check_certificate_expiry_debmonitor]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_debmonitor].orig
  +++ Monitoring::Service[check_certificate_expiry_debmonitor]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: debmonitor
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_debmonitor!10
  

• Prometheus::Node_textfile[prometheus-check-kafka-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-kafka-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-kafka-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-kafka-certificate-expiry --cert-path /etc/cfssl/signers/kafka/ca/kafka.pem --outfile /var/lib/prometheus/node.d/kafka_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer
  

• Systemd::Unit[cfssl-ocsprefresh-debmonitor.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-debmonitor.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-debmonitor.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-debmonitor.service
  

• File[/etc/cfssl/signers/dse/ca/dse-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/dse/ca/dse-key.pem].orig
  +++ File[/etc/cfssl/signers/dse/ca/dse-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[cfssl-ocsprefresh-wikikube.timer]']
  -    refreshonly => True
  

• File[/lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service].orig
  +++ File[/lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service.orig
  +++ /lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service
  @@ -1,15 +0,0 @@
  -[Unit]
  -Description=Cloudflare SSL OCSP Responder (dse_front_proxy)
  -After=network.target remote-fs.target nss-lookup.target
  -Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
  -
  -[Service]
  -ExecStart=/usr/bin/cfssl ocspserve \
  -          -address 127.0.0.1 \
  -          -port 20062 \
  -          -responses /etc/cfssl/ocsp/dse_front_proxy.ocsp
  -Restart=always
  -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/etc/rsyslog.d/40-cfssl-gc-expired-certs.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-cfssl-gc-expired-certs.conf].orig
  +++ File[/etc/rsyslog.d/40-cfssl-gc-expired-certs.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-cfssl-gc-expired-certs.conf.orig
  +++ /etc/rsyslog.d/40-cfssl-gc-expired-certs.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "cfssl-gc-expired-certs" then {
  -    action(
  -        type="omfile" file="/var/log/cfssl-gc-expired-certs/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Nftables::Set[CLOUD_NETWORKS]

  Parameters differences:

  --- Nftables::Set[CLOUD_NETWORKS].orig
  +++ Nftables::Set[CLOUD_NETWORKS]
  
  +    hosts  => ['172.16.0.0/21', '172.16.128.0/24', '172.16.129.0/24', '172.16.130.0/24', '172.16.131.0/24', '172.16.16.0/21', '172.16.24.0/24', '172.16.8.0/21', '172.20.1.0/24', '172.20.2.0/24', '172.20.254.0/24', '172.20.255.0/24', '172.20.3.0/24', '172.20.4.0/24', '172.20.5.0/24', '185.15.56.0/25', '185.15.56.160/28', '185.15.57.0/29', '185.15.57.16/29', '185.15.57.24/29', '2a02:ec80:a000:100::/64', '2a02:ec80:a000:1::/64', '2a02:ec80:a000:201::/64', '2a02:ec80:a000:202::/64', '2a02:ec80:a000:203::/64', '2a02:ec80:a000:204::/64', '2a02:ec80:a000:2ff::/64', '2a02:ec80:a000:4000::/64', '2a02:ec80:a100:100::/64', '2a02:ec80:a100:1::/64', '2a02:ec80:a100:205::/64', '2a02:ec80:a100:2ff::/64', '2a02:ec80:a100:4000::/64']
  +    ensure => present
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Nrpe::Monitor_service[check_certificate_expiry_discovery2026]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_discovery2026].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_discovery2026]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: discovery2026
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
  -    timeout                     => 10
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
  @@ -1,11 +0,0 @@
  -[Unit]
  -Description=execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_staging command.
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=nagios
  -
  -Group=prometheus-node-exporter
  -SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_wikikube_staging
  -ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "f389c556cebfcfc345b3d6802f320045" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_staging"

• Systemd::Timer::Job[nrpe2nodexp-ferm_active]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-ferm_active].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-ferm_active]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => False
  -    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '10min'}]
  -    ignore_errors             => True
  -    private_tmp               => False
  -    description               => execution of nrpe2nodexp for the check_ferm_active command.
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "bba0a2572329bb500b832470e08b381c" --timeout 10 --check-command "check_ferm_active"
  -    logfile_basedir           => /var/log
  -    user                      => nagios
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    group                     => prometheus-node-exporter
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    syslog_identifier         => nrpe2nodexp-ferm_active
  -    fixed_random_delay        => True
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    splay                     => 600
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Cfssl::Config[mlserve_staging_front_proxy]

  Parameters differences:

  --- Cfssl::Config[mlserve_staging_front_proxy].orig
  +++ Cfssl::Config[mlserve_staging_front_proxy]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 72h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/mlserve_staging_front_proxy
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/mlserve_staging_front_proxy
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages      => ['signing', 'key encipherment', 'client auth']
  

• Prometheus::Node_textfile[prometheus-check-network_devices-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-network_devices-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-network_devices-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-network_devices-certificate-expiry --cert-path /etc/cfssl/signers/network_devices/ca/network_devices.pem --outfile /var/lib/prometheus/node.d/network_devices_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• File[/usr/local/bin/prometheus-check-syslog-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-syslog-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-syslog-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• Cfssl::Config[debmonitor]

  Parameters differences:

  --- Cfssl::Config[debmonitor].orig
  +++ Cfssl::Config[debmonitor]
  
  -    notify              => Service[cfssl-multirootca]
  -    path                => /etc/cfssl/signers/debmonitor/cfssl.conf
  -    ensure              => present
  -    default_expiry      => 672h
  -    remotes             => {}
  -    default_crl_url     => http://pki.discovery.wmnet/crl/debmonitor
  -    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
  -    default_auth_remote => {}
  -    default_auth_key    => default_auth
  -    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/debmonitor
  -    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
  -    default_usages      => ['signing', 'key encipherment', 'client auth']
  

• Nrpe::Monitor_service[ferm_active]

  Parameters differences:

  --- Nrpe::Monitor_service[ferm_active].orig
  +++ Nrpe::Monitor_service[ferm_active]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/Monitoring/check_ferm
  -    description                 => Check whether ferm is active by checking the default input chain
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => True
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 30
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/local/lib/nagios/plugins/check_ferm
  -    timeout                     => 10
  

• File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Prometheus::Blackbox::Check::Http[PKI_puppet_rsa]

  Parameters differences:

  --- Prometheus::Blackbox::Check::Http[PKI_puppet_rsa].orig
  +++ Prometheus::Blackbox::Check::Http[PKI_puppet_rsa]
  
  -    client_auth_cert        => /etc/prometheus/ssl/cert.pem
  -    body                    => {}
  -    use_client_auth         => True
  -    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
  -    body_regex_matches      => ['"success":true']
  -    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
  -    status_matches          => []
  -    ip6                     => 2620:0:861:101:10:64:0:10
  -    body_regex_not_matches  => []
  -    follow_redirects        => False
  -    server_name             => pki.discovery.wmnet
  -    team                    => sre
  -    header_matches          => []
  -    path                    => /api/v1/cfssl/info
  -    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
  -    ip4                     => 10.64.0.10
  -    port                    => 443
  -    client_auth_key         => /etc/prometheus/ssl/server.key
  -    site                    => eqiad
  -    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
  -    severity                => critical
  -    insecure_tls            => False
  -    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
  -    prometheus_instance     => ops
  -    certificate_expiry_days => 10
  -    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
  -    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
  -    ip_families             => ['ip4', 'ip6']
  -    body_raw                => {"label":"puppet_rsa"}
  -    header_not_matches      => []
  -    method                  => POST
  -    force_tls               => False
  -    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
  -    alert_after             => 2m
  -    req_headers             => {}
  -    timeout                 => 3s
  -    instance_label          => pki1001
  

• Sudo::User[nrpe-check_check_certificate_expiry_debmonitor]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_certificate_expiry_debmonitor].orig
  +++ Sudo::User[nrpe-check_check_certificate_expiry_debmonitor]
  
  -    require    => ['Class[Sudo]']
  -    ensure     => present
  -    user       => nagios
  -    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem']
  -    tag        => nrpe::check
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/signers/wikikube_front_proxy/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_front_proxy/ca].orig
  +++ File[/etc/cfssl/signers/wikikube_front_proxy/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Prometheus::Node_textfile[prometheus-check-dse-certificate-expiry]

  Parameters differences:

  --- Prometheus::Node_textfile[prometheus-check-dse-certificate-expiry].orig
  +++ Prometheus::Node_textfile[prometheus-check-dse-certificate-expiry]
  
  -    ensure         => present
  -    interval       => daily
  -    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
  -    user           => root
  -    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
  -    run_cmd        => /usr/local/bin/prometheus-check-dse-certificate-expiry --cert-path /etc/cfssl/signers/dse/ca/dse.pem --outfile /var/lib/prometheus/node.d/dse_intermediate.prom
  -    environment    => {}
  -    extra_packages => []
  

• Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh].orig
  +++ Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh]
  
  -    notify      => ['Service[apache2]']
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa  /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet
  
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    subscribe   => File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
  

• Systemd::Service[cfssl-ocsprefresh-aux]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-aux].orig
  +++ Systemd::Service[cfssl-ocsprefresh-aux]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-aux.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Monitoring::Service[check_cfssl-multirootca_status]

  Parameters differences:

  --- Monitoring::Service[check_cfssl-multirootca_status].orig
  +++ Monitoring::Service[check_cfssl-multirootca_status]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 10
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI
  -    passive        => False
  -    description    => Check unit status of cfssl-multirootca
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 2
  -    critical       => True
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_cfssl-multirootca_status!10
  

• File[/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• File[/etc/nftables/prerouting]

  Parameters differences:

  --- File[/etc/nftables/prerouting].orig
  +++ File[/etc/nftables/prerouting]
  
  +    ensure  => directory
  +    purge   => True
  +    recurse => True
  +    owner   => root
  +    group   => root
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-syslog-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• Systemd::Unit[cfssl-ocsprefresh-mlserve.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-mlserve.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-mlserve.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-mlserve.service
  

• Systemd::Unit[cfssl-ocsprefresh-network_devices.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-network_devices.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-network_devices.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-network_devices.service
  

• File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Nrpe::Check[check_check_certificate_expiry_cassandra]

  Parameters differences:

  --- Nrpe::Check[check_check_certificate_expiry_cassandra].orig
  +++ Nrpe::Check[check_check_certificate_expiry_cassandra]
  
  -    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem
  -    before    => Monitoring::Service[check_certificate_expiry_cassandra]
  -    ensure    => present
  -    sudo_user => root
  

• File[/etc/nftables/sets/BASTION_HOSTS_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/BASTION_HOSTS_ipv6.nft].orig
  +++ File[/etc/nftables/sets/BASTION_HOSTS_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/BASTION_HOSTS_ipv6.nft.orig
  +++ /etc/nftables/sets/BASTION_HOSTS_ipv6.nft
  @@ -0,0 +1,12 @@
  +# Autogenerated by puppet
  +set BASTION_HOSTS_ipv6 {
  +    type ipv6_addr
  +    elements = { 2620:0:861:1:208:80:154:7,
  +             2a02:ec80:300:3:185:15:59:99,
  +             2620:0:860:4:208:80:153:110,
  +             2620:0:863:3:198:35:26:104,
  +             2001:df2:e500:3:103:102:166:103,
  +             2a02:ec80:600:1:185:15:58:6,
  +             2a02:ec80:700:3:195:200:68:99
  +    }
  +}

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_puppet_rsa].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Systemd::Timer[cfssl-ocsprefresh-syslog]

  Parameters differences:

  --- Systemd::Timer[cfssl-ocsprefresh-syslog].orig
  +++ Systemd::Timer[cfssl-ocsprefresh-syslog]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => cfssl-ocsprefresh-syslog.service
  

• Sudo::User[nrpe_certificate_check_wikikube]

  Parameters differences:

  --- Sudo::User[nrpe_certificate_check_wikikube].orig
  +++ Sudo::User[nrpe_certificate_check_wikikube]
  
  -    user       => nrpe_certificate_check_wikikube
  -    require    => ['Class[Sudo]']
  -    ensure     => absent
  -    privileges => []
  

• Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

  Parameters differences:

  --- Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
  +++ Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

  Parameters differences:

  --- File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
  +++ File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_cfssl-multirootca_status.timer
  

• Systemd::Service[cfssl-ocspserve@wikikube]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@wikikube].orig
  +++ Systemd::Service[cfssl-ocspserve@wikikube]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Monitoring::Service[check_certificate_expiry_zuul]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_zuul].orig
  +++ Monitoring::Service[check_certificate_expiry_zuul]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: zuul
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_zuul!10
  

• File[/lib/systemd/system/cfssl-ocsprefresh-syslog.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-syslog.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-syslog.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-syslog.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-syslog.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - syslog
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/syslog/ca/syslog.pem --responses-file /etc/cfssl/ocsp/syslog.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@syslog' syslog 

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/sudoers.d/nrpe_certificate_check_aux_front_proxy]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe_certificate_check_aux_front_proxy].orig
  +++ File[/etc/sudoers.d/nrpe_certificate_check_aux_front_proxy]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Systemd::Service[cfssl-multirootca]

  Parameters differences:

  --- Systemd::Service[cfssl-multirootca].orig
  +++ Systemd::Service[cfssl-multirootca]
  
  -    migration_task           => T350694
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => True
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => True
  -    monitoring_notes_url     => https://wikitech.wikimedia.org/wiki/PKI
  -    monitoring_contact_group => admins
  

• File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer
  @@ -1,13 +0,0 @@
  -[Unit]
  -Description=Periodic execution of cfssl-ocsprefresh-wikikube_staging.service
  -
  -[Timer]
  -Unit=cfssl-ocsprefresh-wikikube_staging.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1h
  -OnActiveSec=1s
  -RandomizedDelaySec=0
  -
  -[Install]
  -WantedBy=multi-user.target

• Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft.orig
  +++ /etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft
  @@ -0,0 +1,9 @@
  +# Autogenerated by puppet
  +set MLSERVE_KUBEPODS_NETWORKS_ipv4 {
  +    type ipv4_addr
  +    flags interval
  +    auto-merge
  +    elements = { 10.67.16.0/21,
  +             10.194.16.0/21
  +    }
  +}

• Class[Profile::Firewall::Nftables_base_sets]

  Parameters differences:

  --- Class[Profile::Firewall::Nftables_base_sets].orig
  +++ Class[Profile::Firewall::Nftables_base_sets]
  
  +    kafka_brokers_main    => ['10.192.5.9', '2620:0:860:106:10:192:5:9', '10.192.22.6', '2620:0:860:112:10:192:22:6', '10.192.32.4', '2620:0:860:103:10:192:32:4', '10.192.48.33', '2620:0:860:104:10:192:48:33', '10.192.48.35', '2620:0:860:104:10:192:48:35', '10.64.0.101', '2620:0:861:101:10:64:0:101', '10.64.16.30', '2620:0:861:102:10:64:16:30', '10.64.32.45', '2620:0:861:103:10:64:32:45', '10.64.48.37', '2620:0:861:107:10:64:48:37', '10.64.152.5', '2620:0:861:120:10:64:152:5']
  +    bastion_hosts         => ['208.80.154.7', '2620:0:861:1:208:80:154:7', '208.80.153.110', '2a02:ec80:300:3:185:15:59:99', '185.15.59.99', '2620:0:860:4:208:80:153:110', '198.35.26.104', '2620:0:863:3:198:35:26:104', '103.102.166.103', '2001:df2:e500:3:103:102:166:103', '185.15.58.6', '2a02:ec80:600:1:185:15:58:6', '195.200.68.99', '2a02:ec80:700:3:195:200:68:99']
  +    kafka_brokers_jumbo   => ['10.64.130.10', '2620:0:861:109:10:64:130:10', '10.64.131.16', '2620:0:861:10a:10:64:131:16', '10.64.132.21', '2620:0:861:10b:10:64:132:21', '10.64.134.9', '2620:0:861:10d:10:64:134:9', '10.64.135.16', '2620:0:861:10e:10:64:135:16', '10.64.136.11', '2620:0:861:10f:10:64:136:11', '10.64.154.15', '2620:0:861:122:10:64:154:15', '10.64.160.16', '2620:0:861:128:10:64:160:16', '10.64.0.126', '2620:0:861:101:10:64:0:126']
  +    cache_hosts           => ['10.64.0.79', '2620:0:861:101:10:64:0:79', '10.64.0.229', '2620:0:861:101:10:64:0:229', '10.64.0.14', '2620:0:861:101:10:64:0:14', '10.64.0.51', '2620:0:861:101:10:64:0:51', '10.64.16.241', '2620:0:861:102:10:64:16:241', '10.64.16.94', '2620:0:861:102:10:64:16:94', '10.64.16.95', '2620:0:861:102:10:64:16:95', '10.64.16.240', '2620:0:861:102:10:64:16:240', '10.64.32.14', '2620:0:861:103:10:64:32:14', '10.64.32.60', '2620:0:861:103:10:64:32:60', '10.64.32.15', '2620:0:861:103:10:64:32:15', '10.64.32.65', '2620:0:861:103:10:64:32:65', '10.64.48.16', '2620:0:861:107:10:64:48:16', '10.64.48.41', '2620:0:861:107:10:64:48:41', '10.64.48.27', '2620:0:861:107:10:64:48:27', '10.64.48.28', '2620:0:861:107:10:64:48:28', '10.192.23.26', '2620:0:860:113:10:192:23:26', '10.192.6.20', '2620:0:860:107:10:192:6:20', '10.192.12.35', '2620:0:860:10d:10:192:12:35', '10.192.14.25', '2620:0:860:10f:10:192:14:25', '10.192.4.22', '2620:0:860:100:10:192:4:22', '10.192.29.26', '2620:0:860:116:10:192:29:26', '10.192.30.29', '2620:0:860:119:10:192:30:29', '10.192.36.19', '2620:0:860:11b:10:192:36:19', '10.192.40.25', '2620:0:860:11f:10:192:40:25', '10.192.41.21', '2620:0:860:120:10:192:41:21', '10.192.56.3', '2620:0:860:12b:10:192:56:3', '10.192.56.4', '2620:0:860:12b:10:192:56:4', '10.192.57.3', '2620:0:860:12c:10:192:57:3', '10.192.58.2', '2620:0:860:12d:10:192:58:2', '10.192.58.3', '2620:0:860:12d:10:192:58:3', '10.192.59.2', '2620:0:860:12e:10:192:59:2', '10.80.0.14', '2a02:ec80:300:101:10:80:0:14', '10.80.1.11', '2a02:ec80:300:102:10:80:1:11', '10.80.0.13', '2a02:ec80:300:101:10:80:0:13', '10.80.1.9', '2a02:ec80:300:102:10:80:1:9', '10.80.0.12', '2a02:ec80:300:101:10:80:0:12', '10.80.1.7', '2a02:ec80:300:102:10:80:1:7', '10.80.0.11', '2a02:ec80:300:101:10:80:0:11', '10.80.1.6', '2a02:ec80:300:102:10:80:1:6', '10.80.0.10', '2a02:ec80:300:101:10:80:0:10', '10.80.1.5', '2a02:ec80:300:102:10:80:1:5', '10.80.0.8', '2a02:ec80:300:101:10:80:0:8', '10.80.1.4', '2a02:ec80:300:102:10:80:1:4', '10.80.0.7', '2a02:ec80:300:101:10:80:0:7', '10.80.1.3', '2a02:ec80:300:102:10:80:1:3', '10.80.0.6', '2a02:ec80:300:101:10:80:0:6', '10.80.1.2', '2a02:ec80:300:102:10:80:1:2', '10.128.0.19', '2620:0:863:101:10:128:0:19', '10.128.0.27', '2620:0:863:101:10:128:0:27', '10.128.0.22', '2620:0:863:101:10:128:0:22', '10.128.0.28', '2620:0:863:101:10:128:0:28', '10.128.0.25', '2620:0:863:101:10:128:0:25', '10.128.0.29', '2620:0:863:101:10:128:0:29', '10.128.0.26', '2620:0:863:101:10:128:0:26', '10.128.0.31', '2620:0:863:101:10:128:0:31', '10.128.0.14', '2620:0:863:101:10:128:0:14', '10.128.0.35', '2620:0:863:101:10:128:0:35', '10.128.0.21', '2620:0:863:101:10:128:0:21', '10.128.0.36', '2620:0:863:101:10:128:0:36', '10.128.0.24', '2620:0:863:101:10:128:0:24', '10.128.0.10', '2620:0:863:101:10:128:0:10', '10.128.0.37', '2620:0:863:101:10:128:0:37', '10.128.0.12', '2620:0:863:101:10:128:0:12', '10.132.0.17', '2001:df2:e500:101:10:132:0:17', '10.132.0.18', '2001:df2:e500:101:10:132:0:18', '10.132.0.19', '2001:df2:e500:101:10:132:0:19', '10.132.0.24', '2001:df2:e500:101:10:132:0:24', '10.132.0.29', '2001:df2:e500:101:10:132:0:29', '10.132.0.30', '2001:df2:e500:101:10:132:0:30', '10.132.0.34', '2001:df2:e500:101:10:132:0:34', '10.132.0.35', '2001:df2:e500:101:10:132:0:35', '10.132.0.36', '2001:df2:e500:101:10:132:0:36', '10.132.0.37', '2001:df2:e500:101:10:132:0:37', '10.132.0.38', '2001:df2:e500:101:10:132:0:38', '10.132.0.25', '2001:df2:e500:101:10:132:0:25', '10.132.0.26', '2001:df2:e500:101:10:132:0:26', '10.132.0.27', '2001:df2:e500:101:10:132:0:27', '10.132.0.28', '2001:df2:e500:101:10:132:0:28', '10.132.0.16', '2001:df2:e500:101:10:132:0:16', '10.136.0.6', '2a02:ec80:600:101:10:136:0:6', '10.136.1.6', '2a02:ec80:600:102:10:136:1:6', '10.136.0.7', '2a02:ec80:600:101:10:136:0:7', '10.136.1.7', '2a02:ec80:600:102:10:136:1:7', '10.136.0.8', '2a02:ec80:600:101:10:136:0:8', '10.136.1.8', '2a02:ec80:600:102:10:136:1:8', '10.136.0.9', '2a02:ec80:600:101:10:136:0:9', '10.136.1.9', '2a02:ec80:600:102:10:136:1:9', '10.136.0.10', '2a02:ec80:600:101:10:136:0:10', '10.136.1.10', '2a02:ec80:600:102:10:136:1:10', '10.136.0.11', '2a02:ec80:600:101:10:136:0:11', '10.136.1.11', '2a02:ec80:600:102:10:136:1:11', '10.136.0.12', '2a02:ec80:600:101:10:136:0:12', '10.136.1.12', '2a02:ec80:600:102:10:136:1:12', '10.136.0.13', '2a02:ec80:600:101:10:136:0:13', '10.136.1.13', '2a02:ec80:600:102:10:136:1:13', '10.140.0.3', '2a02:ec80:700:101:10:140:0:3', '10.140.1.4', '2a02:ec80:700:102:10:140:1:4', '10.140.0.4', '2a02:ec80:700:101:10:140:0:4', '10.140.1.5', '2a02:ec80:700:102:10:140:1:5', '10.140.0.5', '2a02:ec80:700:101:10:140:0:5', '10.140.1.6', '2a02:ec80:700:102:10:140:1:6', '10.140.0.6', '2a02:ec80:700:101:10:140:0:6', '10.140.1.7', '2a02:ec80:700:102:10:140:1:7', '10.140.0.7', '2a02:ec80:700:101:10:140:0:7', '10.140.1.8', '2a02:ec80:700:102:10:140:1:8', '10.140.0.8', '2a02:ec80:700:101:10:140:0:8', '10.140.1.9', '2a02:ec80:700:102:10:140:1:9', '10.140.0.9', '2a02:ec80:700:101:10:140:0:9', '10.140.1.10', '2a02:ec80:700:102:10:140:1:10', '10.140.0.10', '2a02:ec80:700:101:10:140:0:10', '10.140.1.11', '2a02:ec80:700:102:10:140:1:11']
  +    lb_health_checks      => ['10.64.0.136', '10.64.16.60', '10.64.158.19', '10.64.166.19', '10.64.133.19', '10.64.141.19', '10.64.169.19', '10.64.171.19', '10.64.173.19', '10.64.175.19', '10.64.177.19', '10.64.179.19', '10.64.181.19', '10.64.183.19', '10.64.185.19', '10.64.187.19', '10.64.189.19', '10.64.48.72', '10.64.37.17', '10.64.1.17', '10.64.17.17', '10.64.33.17', '10.64.130.20', '10.64.131.20', '10.64.132.20', '10.64.134.20', '10.64.135.20', '10.64.136.20', '10.64.158.20', '10.64.166.20', '10.64.133.20', '10.64.141.20', '10.64.169.20', '10.64.171.20', '10.64.173.20', '10.64.175.20', '10.64.177.20', '10.64.179.20', '10.64.181.20', '10.64.183.20', '10.64.185.20', '10.64.187.20', '10.64.189.20', '2620:0:861:101::/64', '2620:0:861:102::/64', '2620:0:861:103::/64', '2620:0:861:107::/64', '2620:0:861:109::/64', '2620:0:861:10a::/64', '2620:0:861:10b::/64', '2620:0:861:10d::/64', '2620:0:861:10e::/64', '2620:0:861:10f::/64', '2620:0:861:119::/64', '2620:0:861:10c::/64', '2620:0:861:113::/64', '2620:0:861:119::/64', '2620:0:861:131::/64', '2620:0:861:133::/64', '2620:0:861:135::/64', '2620:0:861:137::/64', '2620:0:861:139::/64', '2620:0:861:13b::/64', '2620:0:861:13d::/64', '2620:0:861:13f::/64', '2620:0:861:142::/64', '2620:0:861:144::/64', '10.192.23.8', '10.192.0.29', '10.192.17.8', '10.192.33.8', '10.192.49.8', '10.192.23.2', '10.192.5.2', '10.192.6.2', '10.192.7.2', '10.192.8.2', '10.192.9.2', '10.192.10.2', '10.192.11.2', '10.192.12.2', '10.192.13.2', '10.192.14.2', '10.192.15.2', '10.192.21.2', '10.192.22.2', '10.192.4.2', '10.192.26.2', '10.192.27.2', '10.192.28.2', '10.192.29.2', '10.192.30.2', '10.192.31.2', '10.192.36.2', '10.192.37.2', '10.192.38.2', '10.192.39.2', '10.192.40.2', '10.192.41.2', '10.192.42.2', '10.192.43.2', '10.192.11.8', '10.192.16.140', '10.192.1.8', '10.192.33.9', '10.192.49.9', '10.192.23.3', '10.192.5.3', '10.192.6.3', '10.192.7.3', '10.192.8.3', '10.192.9.3', '10.192.10.3', '10.192.11.3', '10.192.12.3', '10.192.13.3', '10.192.14.3', '10.192.15.3', '10.192.21.3', '10.192.22.3', '10.192.4.3', '10.192.26.3', '10.192.27.3', '10.192.28.3', '10.192.29.3', '10.192.30.3', '10.192.31.3', '10.192.36.3', '10.192.37.3', '10.192.38.3', '10.192.39.4', '10.192.40.3', '10.192.41.3', '10.192.42.3', '10.192.43.3', '10.192.32.14', '10.192.1.9', '10.192.17.9', '10.192.49.10', '10.192.23.4', '10.192.5.4', '10.192.6.4', '10.192.7.4', '10.192.8.4', '10.192.9.4', '10.192.10.4', '10.192.11.4', '10.192.12.4', '10.192.13.4', '10.192.14.4', '10.192.15.4', '10.192.21.4', '10.192.22.4', '10.192.4.5', '10.192.26.5', '10.192.27.5', '10.192.28.5', '10.192.29.5', '10.192.30.5', '10.192.31.5', '10.192.36.5', '10.192.37.5', '10.192.38.5', '10.192.39.6', '10.192.40.5', '10.192.41.5', '10.192.42.5', '10.192.43.5', '10.192.48.213', '10.192.1.13', '10.192.17.10', '10.192.33.10', '10.192.23.5', '10.192.5.8', '10.192.6.5', '10.192.7.5', '10.192.8.5', '10.192.9.5', '10.192.10.5', '10.192.11.5', '10.192.12.5', '10.192.13.5', '10.192.14.5', '10.192.15.5', '10.192.21.5', '10.192.22.5', '10.192.4.5', '10.192.26.5', '10.192.27.5', '10.192.28.5', '10.192.29.5', '10.192.30.5', '10.192.31.5', '10.192.36.5', '10.192.37.5', '10.192.38.5', '10.192.39.6', '10.192.40.5', '10.192.41.5', '10.192.42.5', '10.192.43.5', '2620:0:860:101::/64', '2620:0:860:102::/64', '2620:0:860:103::/64', '2620:0:860:104::/64', '10.80.0.3', '10.80.1.8', '10.80.1.14', '10.80.0.9', '10.80.0.2', '10.80.1.10', '2a02:ec80:300:101::/64', '2a02:ec80:300:102::/64', '10.128.0.18', '10.128.0.9', '10.128.0.11', '2620:0:863:101::/64', '10.132.0.39', '10.132.0.6', '10.132.0.7', '2001:df2:e500:101::/64', '10.136.0.16', '10.136.1.19', '10.136.1.15', '10.136.0.19', '10.136.0.17', '10.136.1.20', '2a02:ec80:600:101::/64', '2a02:ec80:600:102::/64', '10.140.0.13', '10.140.1.2', '10.140.1.14', '10.140.0.2', '10.140.0.14', '10.140.1.3', '2a02:ec80:700:101::/64', '2a02:ec80:700:102::/64']
  +    install_hosts6        => {'eqiad': '2620:0:861:2:208:80:154:134', 'codfw': '2620:0:860:3:208:80:153:70', 'esams': '2a02:ec80:300:3:185:15:59:101', 'ulsfo': '2620:0:863:3:198:35:26:98', 'eqsin': '2001:df2:e500:1:103:102:166:11', 'drmrs': '2a02:ec80:600:1:185:15:58:7', 'magru': '2a02:ec80:700:3:195:200:68:100'}
  +    deployment_hosts      => ['10.64.16.93', '2620:0:861:102:10:64:16:93', '10.192.32.7', '2620:0:860:103:10:192:32:7']
  +    mysql_root_clients    => ['10.64.16.90', '10.192.16.191', '10.64.16.154', '10.192.32.49', '208.80.155.103', '208.80.154.9', '10.64.0.20']
  +    install_hosts         => {'eqiad': '208.80.154.134', 'codfw': '208.80.153.70', 'esams': '185.15.59.101', 'ulsfo': '198.35.26.98', 'eqsin': '103.102.166.11', 'drmrs': '185.15.58.7', 'magru': '195.200.68.100'}
  +    druid_public_hosts    => ['10.64.131.9', '2620:0:861:10a:10:64:131:9', '10.64.132.12', '2620:0:861:10b:10:64:132:12', '10.64.135.9', '2620:0:861:10e:10:64:135:9', '10.64.32.101', '2620:0:861:103:10:64:32:101', '10.64.48.185', '2620:0:861:107:10:64:48:185']
  +    zookeeper_flink_hosts => ['10.64.16.9', '2620:0:861:102:10:64:16:9', '10.64.0.8', '2620:0:861:101:10:64:0:8', '10.64.32.41', '2620:0:861:103:10:64:32:41', '10.192.16.227', '2620:0:860:102:10:192:16:227', '10.192.32.179', '2620:0:860:103:10:192:32:179', '10.192.48.219', '2620:0:860:104:10:192:48:219']
  +    kafkamon_hosts        => ['10.64.32.11', '2620:0:861:103:10:64:32:11', '10.192.16.139', '2620:0:860:102:10:192:16:139']
  +    zookeeper_hosts_main  => ['10.64.0.207', '2620:0:861:101:10:64:0:207', '10.64.16.110', '2620:0:861:102:10:64:16:110', '10.64.48.154', '2620:0:861:107:10:64:48:154', '10.192.16.45', '2620:0:860:102:10:192:16:45', '10.192.32.52', '2620:0:860:103:10:192:32:52', '10.192.48.59', '2620:0:860:104:10:192:48:59']
  +    kafka_brokers_logging => ['10.64.16.205', '2620:0:861:102:10:64:16:205', '10.64.133.11', '2620:0:861:10c:10:64:133:11', '10.64.183.12', '2620:0:861:13d:10:64:183:12', '10.64.131.13', '2620:0:861:10a:10:64:131:13', '10.64.135.13', '2620:0:861:10e:10:64:135:13', '10.192.23.29', '2620:0:860:113:10:192:23:29', '10.192.11.28', '2620:0:860:10c:10:192:11:28', '10.192.26.22', '2620:0:860:105:10:192:26:22', '10.192.11.27', '2620:0:860:10c:10:192:11:27', '10.192.39.25', '2620:0:860:11e:10:192:39:25']
  +    prometheus_nodes      => ['prometheus1005.eqiad.wmnet', 'prometheus1006.eqiad.wmnet', 'prometheus1007.eqiad.wmnet', 'prometheus1008.eqiad.wmnet']
  +    labstore_hosts        => ['208.80.154.142', '2620:0:861:2:208:80:154:142', '208.80.154.71', '2620:0:861:3:208:80:154:71']
  +    monitoring_hosts      => ['208.80.154.78', '2620:0:861:3:208:80:154:78', '208.80.153.42', '2620:0:860:2:208:80:153:42']
  +    cumin_masters         => ['10.64.16.154', '2620:0:861:102:10:64:16:154', '10.192.32.49', '2620:0:860:103:10:192:32:49']
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Rsyslog::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

  Parameters differences:

  --- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
  +++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
  
  -    priority => 40
  -    require  => File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
  -    ensure   => present
  -    mode     => 0444
  

• File[/lib/systemd/system/cfssl-ocsprefresh-etcd.service]

  Parameters differences:

  --- File[/lib/systemd/system/cfssl-ocsprefresh-etcd.service].orig
  +++ File[/lib/systemd/system/cfssl-ocsprefresh-etcd.service]
  
  -    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/cfssl-ocsprefresh-etcd.service.orig
  +++ /lib/systemd/system/cfssl-ocsprefresh-etcd.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=OCSP Refresh job - etcd
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/etcd/ca/etcd.pem --responses-file /etc/cfssl/ocsp/etcd.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@etcd' etcd 

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/signers/cassandra/ca]

  Parameters differences:

  --- File[/etc/cfssl/signers/cassandra/ca].orig
  +++ File[/etc/cfssl/signers/cassandra/ca]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-check_certificate_expiry_wikikube" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• File[/etc/nftables/sets/CUMIN_MASTERS_ipv4.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/CUMIN_MASTERS_ipv4.nft].orig
  +++ File[/etc/nftables/sets/CUMIN_MASTERS_ipv4.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/CUMIN_MASTERS_ipv4.nft.orig
  +++ /etc/nftables/sets/CUMIN_MASTERS_ipv4.nft
  @@ -0,0 +1,7 @@
  +# Autogenerated by puppet
  +set CUMIN_MASTERS_ipv4 {
  +    type ipv4_addr
  +    elements = { 10.64.16.154,
  +             10.192.32.49
  +    }
  +}

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
  

• Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)].orig
  +++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr]
  
  -    ensure => file
  -    mode   => 0440
  -    group  => root
  -    owner  => root
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
  
  -    priority => 25
  -    ensure   => absent
  -    mode     => 0444
  

• Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse].orig
  +++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => absent
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Systemd::Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
  +++ Systemd::Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse]
  
  -    require      => Package[nagios-nrpe-server]
  -    ensure       => present
  -    owner        => root
  -    validate_cmd => /usr/sbin/visudo -cqf %
  -    mode         => 0440
  -    group        => root
  

  Content differences:

  --- /etc/sudoers.d/nrpe-check_check_certificate_expiry_dse.orig
  +++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_dse
  @@ -1,3 +0,0 @@
  -# This file is managed by Puppet!
  -
  -nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem

• File[/srv/cfssl/bundles/syslog.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/syslog.pem].orig
  +++ File[/srv/cfssl/bundles/syslog.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/syslog.pem.orig
  +++ /srv/cfssl/bundles/syslog.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDqTCCAwqgAwIBAgIUI5/ixOCtnw8ZXV6xWw6RVC/D6rwwCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjMwOTI4MTAzNzAwWhcNMjgwOTI2MTAzNzAwWjB0
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMQ8wDQYDVQQDEwZzeXNsb2cwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABL
  -CaZwsDnVcBhApShaeA1j8/9w4S2re0Zmjx7GTeBXiJcKF0dAhgAQRCMrGtWEimmQ
  -W94s5015H1MknO61lLOY+wDAFYkq98rZF2aRRILm1w/5iRkqTDiBECBVE15jrPzD
  -q4zZCQ5V5ellWhzfGfPMxFOogIm1sqZsqZvB7zZaCSOrbaOCAQwwggEIMA4GA1Ud
  -DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRvwMc33QVQ
  -qaT1dZmUUtkBeYiyzjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBW
  -BggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5
  -LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMw
  -QTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRp
  -YV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAUtK7APyQamN
  -8DYOBCd1wJQ1DbYlzcQOcupJns2RKKcxFp1evo2GQjDA15TN1OXtA+pvK/liCAEh
  -p828+NcE6fPMAkIBN/Yjhvy0lrtVzshqckUEciShFhbDU0QZOHuzIXCVjdskzQfu
  -as4ZMO15kIv0MZUJ6V9aKEE6nqzi9QXifjuoY54=
  ------END CERTIFICATE-----

• Logrotate::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

  Parameters differences:

  --- Logrotate::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
  +++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
  
  -    ensure => present
  

• Cfssl::Ocsp[puppet_rsa]

  Parameters differences:

  --- Cfssl::Ocsp[puppet_rsa].orig
  +++ Cfssl::Ocsp[puppet_rsa]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 10008
  -    db_driver          => mysql
  

• Nftables::Service[full-monitoring-metrics-access-tcp]

  Parameters differences:

  --- Nftables::Service[full-monitoring-metrics-access-tcp].orig
  +++ Nftables::Service[full-monitoring-metrics-access-tcp]
  
  +    ensure              => present
  +    src_ips             => ['10.64.0.82', '10.64.16.62', '10.64.32.85', '10.64.48.171', '208.80.153.42', '208.80.154.78', '2620:0:860:2:208:80:153:42', '2620:0:861:101:10:64:0:82', '2620:0:861:102:10:64:16:62', '2620:0:861:103:10:64:32:85', '2620:0:861:107:10:64:48:171', '2620:0:861:3:208:80:154:78']
  +    prio                => 10
  +    desc                => 
  +    port_range          => [1, 65535]
  +    proto               => tcp
  +    unrestricted_access => False
  +    notrack             => False
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_front_proxy.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_front_proxy.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_front_proxy.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Rsyslog::Conf[cfssl-ocsprefresh-wikikube]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-wikikube].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-wikikube]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-wikikube]
  -    ensure   => present
  -    mode     => 0444
  

• File[/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry]

  Parameters differences:

  --- File[/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry].orig
  +++ File[/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry]
  
  -    ensure => present
  -    owner  => root
  -    source => puppet:///modules/prometheus/check_certificate_expiry.py
  -    mode   => 0555
  -    group  => root
  

• File[/etc/nftables/100_base_puppet.nft]

  Parameters differences:

  --- File[/etc/nftables/100_base_puppet.nft].orig
  +++ File[/etc/nftables/100_base_puppet.nft]
  
  +    notify  => ['Service[nftables]']
  +    require => File[/etc/nftables/]
  +    ensure  => present
  +    owner   => root
  +    tag     => nft
  +    mode    => 0444
  +    group   => root
  

  Content differences:

  --- /etc/nftables/100_base_puppet.nft.orig
  +++ /etc/nftables/100_base_puppet.nft
  @@ -0,0 +1,45 @@
  +# SPDX-License-Identifier: Apache-2.0
  +table inet base {
  +
  +    # Include all Puppet-managed sets
  +    include "/etc/nftables/sets/*.nft"
  +
  +    chain prerouting {
  +        type filter hook prerouting priority -300;
  +
  +        # Include all Puppet-managed rules targetting prerouting chain
  +        include "/etc/nftables/prerouting/*.nft"
  +        # Include all Puppet-managed exceptions from connection tracking
  +        include "/etc/nftables/notrack/*.nft"
  +    }
  +
  +    chain input {
  +        type filter hook input priority 0 ; policy drop;
  +
  +        ct state related,established accept
  +        iifname "lo" accept
  +        pkttype multicast accept
  +        meta l4proto ipv6-icmp accept
  +        ip protocol icmp accept
  +
  +        # Include all Puppet-managed service definitions for incoming traffic
  +        include "/etc/nftables/input/*.nft"
  +    }
  +
  +    chain output {
  +        type filter hook output priority 0 ; policy accept;
  +
  +        # Include any Puppet-managed client definitions filtering outbound traffic
  +        include "/etc/nftables/output/*.nft"
  +    }
  +
  +    chain postrouting {
  +        type filter hook postrouting priority 0 ;
  +
  +        # Include any Puppet-managed custom rules to mark DSCP bits
  +        include "/etc/nftables/postrouting/*.nft"
  +        # Anything else mark as CS0 / default priority class
  +        ip dscp != cs0 ip dscp set cs0 counter
  +        ip6 dscp != cs0 ip6 dscp set cs0 counter
  +    }
  +}

• Rsyslog::Conf[cfssl-ocsprefresh-discovery]

  Parameters differences:

  --- Rsyslog::Conf[cfssl-ocsprefresh-discovery].orig
  +++ Rsyslog::Conf[cfssl-ocsprefresh-discovery]
  
  -    priority => 40
  -    require  => File[/var/log/cfssl-ocsprefresh-discovery]
  -    ensure   => present
  -    mode     => 0444
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
  

• File[/etc/cfssl/signers/etcd/ca/etcd-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/etcd/ca/etcd-key.pem].orig
  +++ File[/etc/cfssl/signers/etcd/ca/etcd-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/etcd/ca/etcd-key.pem.orig
  +++ /etc/cfssl/signers/etcd/ca/etcd-key.pem
  @@ -1 +0,0 @@
  -##### FAKE FOR PUPPET ######

• File[/etc/nftables/sets/NETWORK_INFRA_ipv6.nft]

  Parameters differences:

  --- File[/etc/nftables/sets/NETWORK_INFRA_ipv6.nft].orig
  +++ File[/etc/nftables/sets/NETWORK_INFRA_ipv6.nft]
  
  +    notify => ['Service[nftables]']
  +    ensure => present
  +    owner  => root
  +    tag    => nft
  +    mode   => 0444
  +    group  => root
  

  Content differences:

  --- /etc/nftables/sets/NETWORK_INFRA_ipv6.nft.orig
  +++ /etc/nftables/sets/NETWORK_INFRA_ipv6.nft
  @@ -0,0 +1,18 @@
  +# Autogenerated by puppet
  +set NETWORK_INFRA_ipv6 {
  +    type ipv6_addr
  +    flags interval
  +    auto-merge
  +    elements = { 2a02:ec80:300:fe00::/55,
  +             2620:0:863:fe00::/55,
  +             2620:0:860:fe00::/55,
  +             2620:0:860:13f::/64,
  +             2620:0:860:139::/64,
  +             2620:0:861:fe00::/55,
  +             2620:0:861:11b::/128,
  +             2620:0:861:130::/64,
  +             2001:df2:e500:fe00::/55,
  +             2a02:ec80:600:fe00::/55,
  +             2a02:ec80:700:fe00::/55
  +    }
  +}

• Cfssl::Ocsp[aux]

  Parameters differences:

  --- Cfssl::Ocsp[aux].orig
  +++ Cfssl::Ocsp[aux]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/aux/ca/aux.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 20050
  -    db_driver          => mysql
  

• Systemd::Service[cfssl-ocsprefresh-puppet_rsa]

  Parameters differences:

  --- Systemd::Service[cfssl-ocsprefresh-puppet_rsa].orig
  +++ Systemd::Service[cfssl-ocsprefresh-puppet_rsa]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Nrpe::Check[check_check_cfssl-multirootca_status]

  Parameters differences:

  --- Nrpe::Check[check_check_cfssl-multirootca_status].orig
  +++ Nrpe::Check[check_check_cfssl-multirootca_status]
  
  -    command => /usr/local/lib/nagios/plugins/check_systemd_unit_status cfssl-multirootca
  -    before  => Monitoring::Service[check_cfssl-multirootca_status]
  -    ensure  => present
  

• File[/etc/cfssl/signers/wikikube_staging]

  Parameters differences:

  --- File[/etc/cfssl/signers/wikikube_staging].orig
  +++ File[/etc/cfssl/signers/wikikube_staging]
  
  -    require => ['Package[golang-cfssl]']
  -    ensure  => directory
  -    owner   => root
  -    mode    => 0550
  -    group   => root
  

• Systemd::Timer[wmf_auto_restart_apache2]

  Parameters differences:

  --- Systemd::Timer[wmf_auto_restart_apache2].orig
  +++ Systemd::Timer[wmf_auto_restart_apache2]
  
  -    fixed_random_delay => False
  -    ensure             => present
  -    accuracy           => 15sec
  -    splay              => 0
  -    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 22:8:00'}]
  -    unit_name          => wmf_auto_restart_apache2.service
  

• Systemd::Unit[cfssl-multirootca]

  Parameters differences:

  --- Systemd::Unit[cfssl-multirootca].orig
  +++ Systemd::Unit[cfssl-multirootca]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => True
  -    unit              => cfssl-multirootca
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: discovery
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_discovery!10
  

• Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_front_proxy]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_front_proxy].orig
  +++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_front_proxy]
  
  -    notification_period    => 24x7
  -    retry_interval         => 1
  -    passive_checks_enabled => 1
  -    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    check_freshness        => 0
  -    servicegroups          => pki_eqiad
  -    notification_options   => c,r,f
  -    notification_interval  => 0
  -    contact_groups         => admins
  -    is_volatile            => 0
  -    ensure                 => present
  -    check_interval         => 1
  -    check_period           => 24x7
  -    notifications_enabled  => 1
  -    max_check_attempts     => 3
  -    host_name              => pki1001
  -    service_description    => Check to ensure the signer certificate is valid CA: mlserve_front_proxy
  -    active_checks_enabled  => 1
  -    check_command          => nrpe_check!check_check_certificate_expiry_mlserve_front_proxy!10
  

• File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse.prom]
  
  -    ensure => absent
  -    group  => root
  -    owner  => root
  

• Systemd::Service[cfssl-ocspserve@kafka]

  Parameters differences:

  --- Systemd::Service[cfssl-ocspserve@kafka].orig
  +++ Systemd::Service[cfssl-ocspserve@kafka]
  
  -    migration_task           => T407130
  -    unit_type                => service
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => True
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf
  @@ -1,10 +0,0 @@
  -# SPDX-License-Identifier: Apache-2.0
  -if $programname contains "nrpe2nodexp-ferm_active" then {
  -    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  -        # Send logs to kafka
  -        set $.log_outputs = "kafka ecs_170 local";
  -    } else {
  -        # Filter out non-relevant nrpe2nodexp messages
  -        stop
  -    }
  -}

• File[/etc/apache2/ports.conf]

  Parameters differences:

  --- File[/etc/apache2/ports.conf].orig
  +++ File[/etc/apache2/ports.conf]
  
  -    notify  => Service[apache2]
  -    require => Package[apache2]
  -    ensure  => file
  -    owner   => root
  -    source  => puppet:///modules/httpd/default-ports.conf
  -    group   => root
  

• Systemd::Service[wmf_auto_restart_ulogd2]

  Parameters differences:

  --- Systemd::Service[wmf_auto_restart_ulogd2].orig
  +++ Systemd::Service[wmf_auto_restart_ulogd2]
  
  -    migration_task           => T407130
  -    unit_type                => timer
  -    ensure                   => present
  -    monitoring_critical      => False
  -    restart                  => False
  -    require                  => Systemd::Unit[wmf_auto_restart_ulogd2.service]
  -    service_params           => {}
  -    override                 => False
  -    monitoring_enabled       => False
  -    monitoring_contact_group => admins
  

• Service[wmf_auto_restart_apache-htcacheclean.timer]

  Parameters differences:

  --- Service[wmf_auto_restart_apache-htcacheclean.timer].orig
  +++ Service[wmf_auto_restart_apache-htcacheclean.timer]
  
  -    provider => systemd
  -    ensure   => stopped
  -    enable   => False
  -    before   => ['Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]']
  

• Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet refresh]

  Parameters differences:

  --- Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet refresh].orig
  +++ Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery2026 -profile ocsp /etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet
  
  -    subscribe   => File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
  -    refreshonly => True
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_zuul.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_zuul.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• Monitoring::Service[check_certificate_expiry_aux_front_proxy]

  Parameters differences:

  --- Monitoring::Service[check_certificate_expiry_aux_front_proxy].orig
  +++ Monitoring::Service[check_certificate_expiry_aux_front_proxy]
  
  -    migration_task => T350694
  -    contact_group  => admins
  -    ensure         => present
  -    check_interval => 1
  -    retry_interval => 1
  -    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    passive        => False
  -    description    => Check to ensure the signer certificate is valid CA: aux_front_proxy
  -    config_dir     => /etc/nagios
  -    host           => pki1001
  -    retries        => 3
  -    critical       => False
  -    freshness      => 36000
  -    check_command  => nrpe_check!check_check_certificate_expiry_aux_front_proxy!10
  

• Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

  Parameters differences:

  --- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
  +++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => Systemd timer to gather node metrics for prometheus-check-syslog-certificate-expiry
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/bin/prometheus-check-syslog-certificate-expiry --cert-path /etc/cfssl/signers/syslog/ca/syslog.pem --outfile /var/lib/prometheus/node.d/syslog_intermediate.prom
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• File[/etc/nftables/notrack]

  Parameters differences:

  --- File[/etc/nftables/notrack].orig
  +++ File[/etc/nftables/notrack]
  
  +    ensure  => directory
  +    purge   => True
  +    recurse => True
  +    owner   => root
  +    group   => root
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_etcd.timer
  

• Profile::Pki::Multirootca::Monitoring[wikikube]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[wikikube].orig
  +++ Profile::Pki::Multirootca::Monitoring[wikikube]
  
  -    intermediate => wikikube
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/wikikube/ca/wikikube.pem
  

• Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => absent
  -    override          => False
  -    restart           => False
  -    unit              => nrpe2nodexp-check_certificate_expiry_kafka.timer
  

• Nrpe::Monitor_service[check_certificate_expiry_discovery]

  Parameters differences:

  --- Nrpe::Monitor_service[check_certificate_expiry_discovery].orig
  +++ Nrpe::Monitor_service[check_certificate_expiry_discovery]
  
  -    migration_task              => T350694
  -    retry_interval              => 1
  -    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
  -    description                 => Check to ensure the signer certificate is valid CA: discovery
  -    sudo_user                   => root
  -    alertmanager_team           => observability
  -    enable_nrpe2nodexp          => False
  -    enable_icinga_check         => True
  -    nrpe2nodexp_parse_perf_data => False
  -    contact_group               => admins
  -    ensure                      => present
  -    check_interval              => 1
  -    retries                     => 3
  -    critical                    => False
  -    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem
  -    timeout                     => 10
  

• Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

  Parameters differences:

  --- Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer].orig
  +++ Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer
  

• File[/srv/cfssl/bundles/cloud_wmnet_ca.pem]

  Parameters differences:

  --- File[/srv/cfssl/bundles/cloud_wmnet_ca.pem].orig
  +++ File[/srv/cfssl/bundles/cloud_wmnet_ca.pem]
  
  -    ensure => file
  -    mode   => 0444
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /srv/cfssl/bundles/cloud_wmnet_ca.pem.orig
  +++ /srv/cfssl/bundles/cloud_wmnet_ca.pem
  @@ -1,22 +0,0 @@
  ------BEGIN CERTIFICATE-----
  -MIIDrzCCAxKgAwIBAgIURAaLNJ85iLqv3Tqt4ylu7Dhe0o0wCgYIKoZIzj0EAwQw
  -gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
  -YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
  -MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
  -dGVybmFsX1Jvb3RfQ0EwHhcNMjExMjEzMTg1NTAwWhcNMjYxMjEyMTg1NTAwWjB8
  -MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
  -V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
  -b25zMRcwFQYDVQQDDA5jbG91ZF93bW5ldF9jYTCBmzAQBgcqhkjOPQIBBgUrgQQA
  -IwOBhgAEAFsH4mfZKGu87WTpX9yabGE0+vO4UBQaN/IUGnjmscZTZ7761iAwuZcs
  -33yjwzoX2W+R0IwAPJbagtB92uYPmA6eAUDV4WAuOml+AqAP0elVtW7i+T/Bm4qc
  -SrlGCDsALgJ765YZCDS9OmzAm9rXbQXFmsxqrm9I3aPXIOWIww5+Zg1mo4IBDDCC
  -AQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
  -FMavCWJlEuGLgOx5zgBdQCQ0Zxj7MB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGD
  -kdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5k
  -aXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBK
  -BgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwv
  -V2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYoAMIGGAkEQ
  -XFKpUB99oxOp7uK3GztZblTr8DECjcwbJOXYfZLGyfzzNIKPMGPkBGNmGkP7Ie1G
  -RSCNRsI1VR8/geUR0YUrpwJBRZWF4DZM3cga+6VB7pEv/7r/pQERs/ivzckNwDLi
  -/LK1pbHc/MeNOdoy7TouLf1djsw40VYtGNT7/9FldHoWqsA=
  ------END CERTIFICATE-----

• Logrotate::Conf[wmf_auto_restart_apache-htcacheclean]

  Parameters differences:

  --- Logrotate::Conf[wmf_auto_restart_apache-htcacheclean].orig
  +++ Logrotate::Conf[wmf_auto_restart_apache-htcacheclean]
  
  -    ensure => absent
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_kafka.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_kafka.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]

  Parameters differences:

  --- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service].orig
  +++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]
  
  -    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service.orig
  +++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
  @@ -1,8 +0,0 @@
  -[Unit]
  -Description=Systemd timer to gather node metrics for prometheus-check-puppet_rsa-certificate-expiry
  -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -
  -[Service]
  -Type=oneshot
  -User=root
  -ExecStart=/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry --cert-path /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --outfile /var/lib/prometheus/node.d/puppet_rsa_intermediate.prom

• File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem].orig
  +++ File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem]
  
  -    notify    => Service[cfssl-multirootca]
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0400
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem.orig
  +++ /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem
  @@ -1 +0,0 @@
  -nosecret

• Systemd::Timer::Job[cfssl-ocsprefresh-etcd]

  Parameters differences:

  --- Systemd::Timer::Job[cfssl-ocsprefresh-etcd].orig
  +++ Systemd::Timer::Job[cfssl-ocsprefresh-etcd]
  
  -    send_mail_to              => root@pki1001.eqiad.wmnet
  -    logging_enabled           => True
  -    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
  -    ignore_errors             => False
  -    private_tmp               => False
  -    description               => OCSP Refresh job - etcd
  -    syslog_match_startswith   => True
  -    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/etcd/ca/etcd.pem --responses-file /etc/cfssl/ocsp/etcd.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@etcd' etcd 
  -    logfile_basedir           => /var/log
  -    user                      => root
  -    environment               => {}
  -    logfile_name              => syslog.log
  -    send_mail_only_on_error   => True
  -    logfile_group             => root
  -    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  -    fixed_random_delay        => False
  -    ensure                    => present
  -    success_exit_status       => []
  -    syslog_force_stop         => True
  -    logfile_perms             => all
  -    monitoring_contact_groups => admins
  -    send_mail                 => False
  -    monitoring_enabled        => False
  

• Profile::Pki::Multirootca::Monitoring[zuul]

  Parameters differences:

  --- Profile::Pki::Multirootca::Monitoring[zuul].orig
  +++ Profile::Pki::Multirootca::Monitoring[zuul]
  
  -    intermediate => zuul
  -    vhost        => pki.discovery.wmnet
  -    ensure       => present
  -    ca_file      => /etc/cfssl/signers/zuul/ca/zuul.pem
  

• Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• Exec[renew certificate - OCSP_zuul_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_zuul_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_zuul_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label zuul -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service]

  Parameters differences:

  --- Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service].orig
  +++ Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service]
  
  -    require           => ['Class[Systemd]']
  -    override_filename => puppet-override.conf
  -    ensure            => present
  -    override          => False
  -    restart           => False
  -    unit              => cfssl-ocsprefresh-aux_front_proxy.service
  

• Exec[renew certificate - OCSP_discovery2026_pki1001_eqiad_wmnet]

  Parameters differences:

  --- Exec[renew certificate - OCSP_discovery2026_pki1001_eqiad_wmnet].orig
  +++ Exec[renew certificate - OCSP_discovery2026_pki1001_eqiad_wmnet]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery2026 -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet
  
  -    require     => Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem -checkend 952200
  

• Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

  Parameters differences:

  --- Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer].orig
  +++ Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]
  
  -    provider => systemd
  -    ensure   => running
  -    enable   => True
  

• Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux].orig
  +++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux]
  
  -    fixed_random_delay => True
  -    ensure             => absent
  -    accuracy           => 15sec
  -    splay              => 60
  -    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  -    unit_name          => nrpe2nodexp-check_certificate_expiry_aux.service
  

• File[/etc/cfssl/signers/mlserve/cfssl.conf]

  Parameters differences:

  --- File[/etc/cfssl/signers/mlserve/cfssl.conf].orig
  +++ File[/etc/cfssl/signers/mlserve/cfssl.conf]
  
  -    show_diff => False
  -    ensure    => present
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

  Content differences:

  --- /etc/cfssl/signers/mlserve/cfssl.conf.orig
  +++ /etc/cfssl/signers/mlserve/cfssl.conf
  @@ -1,81 +0,0 @@
  -{
  -  "auth_keys": {
  -    "default_auth": {
  -      "key": "aaaabbbbccccdddd",
  -      "type": "standard"
  -    },
  -    "k8s_staging": {
  -      "key": "ddddccccbbbbaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_wikikube": {
  -      "key": "ddddccccbbbbaaab",
  -      "type": "standard"
  -    },
  -    "k8s_mlserve": {
  -      "key": "bbbbccccddddaaaa",
  -      "type": "standard"
  -    },
  -    "k8s_mlstaging": {
  -      "key": "ccccbbbbaaaadddd",
  -      "type": "standard"
  -    },
  -    "k8s_dse": {
  -      "key": "bbbbaaaaddddcccc",
  -      "type": "standard"
  -    },
  -    "k8s_aux": {
  -      "key": "ffffffffffffffff",
  -      "type": "standard"
  -    }
  -  },
  -  "signing": {
  -    "default": {
  -      "auth_key": "default_auth",
  -      "usages": [
  -        "signing",
  -        "key encipherment",
  -        "client auth"
  -      ],
  -      "expiry": "672h",
  -      "crl_url": "http://pki.discovery.wmnet/crl/mlserve",
  -      "ocsp_url": "http://pki.discovery.wmnet/ocsp/mlserve"
  -    },
  -    "profiles": {
  -      "ocsp": {
  -        "auth_key": "default_auth",
  -        "expiry": "43800h",
  -        "usages": [
  -          "digital signature",
  -          "ocsp signing"
  -        ]
  -      },
  -      "server": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "server auth"
  -        ]
  -      },
  -      "service-account-management": {
  -        "auth_key": "default_auth",
  -        "expiry": "672h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment"
  -        ]
  -      },
  -      "prometheus": {
  -        "auth_key": "default_auth",
  -        "expiry": "8760h",
  -        "usages": [
  -          "digital signature",
  -          "key encipherment",
  -          "client auth"
  -        ]
  -      }
  -    }
  -  }
  -}

• Systemd::Syslog[cfssl-ocsprefresh-zuul]

  Parameters differences:

  --- Systemd::Syslog[cfssl-ocsprefresh-zuul].orig
  +++ Systemd::Syslog[cfssl-ocsprefresh-zuul]
  
  -    readable_by            => all
  -    base_dir               => /var/log
  -    log_filename           => syslog.log
  -    ensure                 => present
  -    force_stop             => True
  -    programname_comparison => startswith
  -    owner                  => root
  -    group                  => root
  

• File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf].orig
  +++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf]
  
  -    notify => Service[rsyslog]
  -    ensure => present
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf.orig
  +++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf
  @@ -1,10 +0,0 @@
  -# rsyslog.conf(5) configuration file for services.
  -# This file is managed by Puppet.
  -if $programname startswith "prometheus-node-textfile-prometheus-check-aux-certificate-expiry" then {
  -    action(
  -        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry/syslog.log"
  -        fileOwner="root" fileGroup="root"
  -        fileCreateMode="0644"
  -    )
  -    & stop
  -}

• File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

  Parameters differences:

  --- File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
  +++ File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
  
  -    backup => False
  -    ensure => directory
  -    force  => True
  -    owner  => root
  -    mode   => 0755
  -    group  => root
  

• Package[ferm]

  Parameters differences:

  --- Package[ferm].orig
  +++ Package[ferm]
  
  @@
  -    ensure => installed
  +    ensure => purged
  

• File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
  +++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem]
  
  -    backup    => False
  -    show_diff => False
  -    ensure    => file
  -    owner     => root
  -    mode      => 0440
  -    group     => root
  

• Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)]

  Parameters differences:

  --- Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)].orig
  +++ Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)]
  
  -    command     => /bin/systemctl daemon-reload
  -    notify      => ['Service[cfssl-multirootca]']
  -    refreshonly => True
  

• File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer]
  
  -    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]
  -    ensure => absent
  -    owner  => root
  -    mode   => 0444
  -    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer
  @@ -1,14 +0,0 @@
  -[Unit]
  -Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_etcd.service
  -
  -[Timer]
  -Unit=nrpe2nodexp-check_certificate_expiry_etcd.service
  -# Accuracy sets the maximum time interval around the execution time we want to allow
  -AccuracySec=15sec
  -OnUnitInactiveSec=1min
  -OnActiveSec=1s
  -RandomizedDelaySec=60
  -FixedRandomDelay=true
  -
  -[Install]
  -WantedBy=multi-user.target

• Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)].orig
  +++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    before      => ['Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]']
  -    refreshonly => True
  

• File[/etc/cfssl/ssl/ocsp]

  Parameters differences:

  --- File[/etc/cfssl/ssl/ocsp].orig
  +++ File[/etc/cfssl/ssl/ocsp]
  
  -    ensure  => directory
  -    recurse => True
  -    owner   => root
  -    mode    => 0740
  -    group   => root
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]
  
  -    command     => /bin/systemctl daemon-reload
  -    refreshonly => True
  

• Cfssl::Ocsp[etcd]

  Parameters differences:

  --- Cfssl::Ocsp[etcd].orig
  +++ Cfssl::Ocsp[etcd]
  
  -    log_level          => info
  -    ocsprefresh_update => True
  -    ca_file            => /etc/cfssl/signers/etcd/ca/etcd.pem
  -    refresh_interval   => 96h
  -    db_conf_file       => /etc/cfssl/db.conf
  -    common_name        => pki1001.eqiad.wmnet
  -    additional_names   => []
  -    listen_addr        => 127.0.0.1
  -    listen_port        => 10005
  -    db_driver          => mysql