Compilation results for pki1001.eqiad.wmnet: System changes detected

You can retrieve this result from host.json.

Catalog differences

Summary

Total Resources:	4897
Resources added:	5
Resources removed:	2136
Resources modified:	2157
Change percentage:	87.77%

Resources only in the new catalog

Class[Role::Insetup::Infrastructure_foundations_ferm]
Motd::Message[insetup::infrastructure_foundations_ferm]
File[/etc/update-motd.d/05-insetup--infrastructure-foundations-ferm]
Node[__node_regexp__pki1001.eqiad.]
Motd::Script[insetup::infrastructure_foundations_ferm]

Resources only in the old catalog

Logrotate::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse]
Rsyslog::Conf[cfssl-ocsprefresh-discovery2026]
Cfssl::Ocsp[mlserve_staging_front_proxy]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service]
File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.service]
File[/var/log/wmf_auto_restart_apache2]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]
Monitoring::Service[check_certificate_expiry_dse_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)]
File[/srv/cfssl/bundles/discovery.pem]
File[/usr/local/bin/prometheus-check-zuul-certificate-expiry]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
Systemd::Service[cfssl-ocsprefresh-wikikube_front_proxy]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]
File[/etc/cfssl/signers/aux/ca/aux.pem]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf]
Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet]
File[/var/log/cfssl-ocsprefresh-aux]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
Nrpe::Plugin[check_systemd_unit_status]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
File[/etc/cfssl/signers/aux/ca]
File[/etc/cfssl/ssl/ocsp]
Systemd::Timer::Job[cfssl-ocsprefresh-discovery]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]
Rsyslog::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg]
File[/etc/cfssl/signers/wikikube_front_proxy]
Service[apache-htcacheclean]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery]
File[/etc/cfssl/signers/wikikube]
File[/etc/apache2/conf-enabled/00-defaults.conf]
Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Sudo::User[nrpe-check_check_certificate_expiry_aux]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer]
Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet refresh]
File[/lib/systemd/system/cfssl-ocspserve@dse.service]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026]
File[/var/log/cfssl-ocsprefresh-wikikube]
File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy]
Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)]
Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
File[/lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service]
Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]
Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
Package[python3-cryptography]
File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
File_line[load_env_enabled]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_zuul]
Logrotate::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]
Exec[Generate initial CRL for wikikube]
File[/etc/cfssl/signers/debmonitor]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)]
File[/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-aux.service]
Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]
Httpd::Conf[pki.discovery.wmnet]
Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]
Cfssl::Config[mlserve_staging]
Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)]
Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse]
Exec[renew certificate - OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
Service[cfssl-ocsprefresh-wikikube_staging.timer]
Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]
Prometheus::Blackbox::Check::Http[PKI_wikikube_front_proxy]
File[/lib/systemd/system/cfssl-ocspserve@wikikube.service]
Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet refresh]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]
Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
Rsyslog::Conf[cfssl-ocsprefresh-dse]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]
Systemd::Unit[cfssl-ocsprefresh-discovery2026.service]
Logrotate::Conf[cfssl-ocsprefresh-mlserve]
Sudo::User[nrpe-check_check_certificate_expiry_debmonitor]
File[/etc/logrotate.d/wmf_auto_restart_apache2]
Exec[Generate initial CRL for mlserve]
Prometheus::Alert::Rule[check_check_certificate_expiry_discovery_38e4dbcfd07ed60daf5bb89397abbe29]
File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
Sudo::User[nrpe_certificate_check_dse]
File[/etc/cfssl/signers/discovery/ca/discovery-key.pem]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)]
Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.timer]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]
File[/var/log/cfssl-ocsprefresh-kafka]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.timer]
Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet refresh]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse_front_proxy.prom]
Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)]
Exec[Generate initial CRL for cassandra]
Profile::Auto_restarts::Service[apache-htcacheclean]
File[/etc/cfssl/signers/wikikube_staging]
Sudo::User[nrpe_certificate_check_mlserve_front_proxy]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve]
File[/etc/apache2/env-enabled]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)]
Exec[renew certificate - OCSP_etcd_pki1001_eqiad_wmnet]
Exec[ensure_present_mod_access_compat]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_kafka]
Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]
Sudo::User[nrpe_certificate_check_wikikube_staging]
Systemd::Service[cfssl-ocsprefresh-mlserve_staging_front_proxy]
Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Exec[renew certificate - OCSP_debmonitor_pki1001_eqiad_wmnet]
Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)]
Exec[renew certificate - OCSP_wikikube_pki1001_eqiad_wmnet]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg]
Systemd::Timer[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
File[/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf]
Systemd::Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)]
Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging]
File[/etc/cfssl/signers/zuul]
Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
File[/etc/cfssl/signers/debmonitor/ca]
Systemd::Timer[cfssl-ocsprefresh-debmonitor]
File[/lib/systemd/system/cfssl-ocspserve@kafka.service]
Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)]
Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)]
Exec[renew certificate - OCSP_mlserve_pki1001_eqiad_wmnet]
File[/etc/apache2/sites-available/50-pki-discovery-wmnet.conf]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging]
File[/etc/sudoers.d/nrpe_certificate_check_network_devices]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging_front_proxy]
Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet refresh]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)]
Service[cfssl-ocspserve@mlserve_front_proxy]
Systemd::Service[cfssl-ocsprefresh-wikikube]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]
Profile::Pki::Multirootca::Monitoring[mlserve_front_proxy]
Systemd::Unit[cfssl-ocsprefresh-etcd.timer]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem]
File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem]
Systemd::Timer[wmf_auto_restart_apache-htcacheclean]
Service[nrpe2nodexp-check_certificate_expiry_discovery.timer]
File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem]
Profile::Pki::Multirootca::Monitoring[etcd]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging_front_proxy]
File[/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem]
File[/usr/local/bin/prometheus-check-etcd-certificate-expiry]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service]
File[/etc/cfssl/ocsp/dse_front_proxy.ocsp]
Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]
File[/etc/cfssl/signers/syslog/ca/syslog.pem]
File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf]
File[/etc/cfssl/signers/aux]
Cfssl::Cert[OCSP_syslog_pki1001_eqiad_wmnet]
Systemd::Override[apache2-after-network-online-target]
Cfssl::Ocsp[dse_front_proxy]
File[/etc/cfssl/signers/mlserve_front_proxy/ca]
Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet refresh]
File[/etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy]
Rsyslog::Conf[cfssl-ocsprefresh-cassandra]
File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux_front_proxy.prom]
Systemd::Timer[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]
Systemd::Unit[cfssl-ocspserve@aux]
Class[Cfssl::Multirootca]
Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]
File[/etc/sudoers.d/nrpe_certificate_check_mlserve_front_proxy]
Cfssl::Config[dse_front_proxy]
Sudo::User[nrpe-check_check_certificate_expiry_puppet_rsa]
Exec[renew certificate - OCSP_dse_pki1001_eqiad_wmnet]
Sudo::User[nrpe_certificate_check_zuul]
File[/lib/systemd/system/cfssl-ocsprefresh-etcd.timer]
Nrpe::Check[check_check_certificate_expiry_mlserve]
File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer]
Systemd::Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf]
Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy]
File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve]
Cfssl::Signer[aux_front_proxy]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer]
Systemd::Service[cfssl-ocsprefresh-dse]
File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service]
Service[cfssl-ocspserve@discovery2026]
File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy]
Cfssl::Cert[OCSP_puppet_rsa_pki1001_eqiad_wmnet]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging]
Systemd::Timer[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
File[/etc/cfssl/signers/wikikube/cfssl.conf]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]
Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet refresh]
Systemd::Syslog[cfssl-ocsprefresh-puppet_rsa]
File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube]
File[/srv/cfssl/bundles/Puppet_Internal_CA.pem.pem]
Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet refresh]
Systemd::Syslog[cfssl-ocsprefresh-syslog]
File[/etc/sudoers.d/nrpe_certificate_check_puppet_rsa]
File[/etc/cfssl/signers/network_devices]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf]
Cfssl::Signer[etcd]
Httpd::Mod_conf[access_compat]
Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]
Systemd::Unit[cfssl-ocspserve@mlserve]
Systemd::Service[cfssl-ocspserve@syslog]
Cfssl::Cert[OCSP_dse_pki1001_eqiad_wmnet]
Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]
Nrpe::Check[check_check_certificate_expiry_debmonitor]
Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.timer]
Httpd::Site[pki.discovery.wmnet]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_puppet_rsa.prom]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem]
File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
Systemd::Unit[cfssl-multirootca]
Service[cfssl-gc-expired-certs.timer]
Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)]
Class[Sslcert::Dhparam]
Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
Systemd::Service[cfssl-ocspserve@discovery]
File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]
Class[Profile::Pki::Multirootca]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service]
Cfssl::Ocsp[kafka]
File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem]
Sudo::User[nrpe_certificate_check_kafka]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
File[/etc/cfssl/signers/etcd/ca/etcd-key.pem]
Cfssl::Signer[wikikube]
Exec[renew certificate - OCSP_zuul_pki1001_eqiad_wmnet]
File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet]
File[/etc/cfssl/signers/discovery/ca]
File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
Profile::Pki::Multirootca::Monitoring[aux]
Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy]
Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]
Service[cfssl-ocspserve@network_devices]
Rsyslog::Conf[cfssl-ocsprefresh-syslog]
Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
Cfssl::Config[wikikube_staging_front_proxy]
Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]
Monitoring::Service[check_certificate_expiry_aux]
Cfssl::Cert[OCSP_mlserve_pki1001_eqiad_wmnet]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem]
Nrpe::Monitor_service[check_certificate_expiry_network_devices]
Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)]
File[/etc/cfssl/signers/wikikube_staging/cfssl.conf]
File[/etc/apache2/conf-available/50-server-status.conf]
Prometheus::Blackbox::Check::Http[PKI_puppet_rsa]
Sudo::User[nrpe-check_check_certificate_expiry_cloud_wmnet_ca]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery]
Sudo::User[nrpe_certificate_check_discovery]
Nrpe::Monitor_service[check_certificate_expiry_discovery2026]
File[/etc/apache2/ports.conf]
Systemd::Timer[cfssl-ocsprefresh-dse]
Rsyslog::Conf[wmf_auto_restart_apache-htcacheclean]
File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem]
Nrpe::Check[check_check_certificate_expiry_aux_front_proxy]
Prometheus::Blackbox::Check::Http[PKI_kafka]
Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]
Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service]
File[/lib/systemd/system/cfssl-ocspserve@puppet_rsa.service]
File[/etc/cfssl/ocsp/wikikube_staging.ocsp]
Nrpe::Check[check_check_certificate_expiry_wikikube_staging]
File[/usr/local/bin/prometheus-check-discovery-certificate-expiry]
File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr]
Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Systemd::Timer[cfssl-ocsprefresh-syslog]
Monitoring::Service[check_certificate_expiry_aux_front_proxy]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
File[/etc/cfssl/signers/debmonitor/ca/debmonitor.pem]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_zuul.prom]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]
File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer]
File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]
Cfssl::Ocsp[zuul]
File[/var/log/cfssl-ocsprefresh-aux_front_proxy]
Profile::Auto_restarts::Service[apache2]
File[/etc/cfssl/signers/cassandra/cfssl.conf]
File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_kafka]
File[/srv/cfssl/bundles/zuul.pem]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf]
Exec[Generate initial CRL for zuul]
Logrotate::Conf[cfssl-ocsprefresh-aux_front_proxy]
Cfssl::Config[zuul]
Service[nrpe2nodexp-check_certificate_expiry_mlserve.timer]
Cfssl::Cert[OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf]
Systemd::Unit[cfssl-ocsprefresh-wikikube.timer]
Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)]
Nrpe::Monitor_service[check_certificate_expiry_discovery]
File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)]
Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]
File[/etc/cfssl/signers/syslog/cfssl.conf]
File[/etc/sudoers.d/nrpe_certificate_check_debmonitor]
File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
Package[links]
File[/srv/cfssl/bundles/mlserve.pem]
Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
Cfssl::Ocsp[mlserve]
File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
Systemd::Unit[wmf_auto_restart_apache2.service]
Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]
Exec[renew certificate - OCSP_mlserve_staging_pki1001_eqiad_wmnet]
Systemd::Syslog[cfssl-ocsprefresh-wikikube_front_proxy]
File[/lib/systemd/system/cfssl-ocspserve@network_devices.service]
Service[cfssl-ocspserve@etcd]
File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.timer]
File_line[auto_restart_file_presence_apache2]
File[/etc/cfssl/signers/dse/ca/dse-key.pem]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf]
Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf]
Prometheus::Alert::Rule[check_check_certificate_expiry_discovery2026_bf2e3510cb63e5f05f545e816bab4edf]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
Systemd::Timer[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
Exec[Generate initial CRL for dse_front_proxy]
Systemd::Timer[cfssl-ocsprefresh-etcd]
Systemd::Service[cfssl-ocsprefresh-puppet_rsa]
Nrpe::Monitor_service[check_certificate_expiry_dse]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)]
File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging]
Profile::Pki::Multirootca::Monitoring[dse]
File[/usr/local/bin/prometheus-check-discovery2026-certificate-expiry]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer]
File[/etc/cfssl/ocsp/dse.ocsp]
Cfssl::Cert[OCSP_debmonitor_pki1001_eqiad_wmnet]
Prometheus::Blackbox::Check::Http[PKI_discovery2026]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf]
Systemd::Monitor[cfssl-multirootca]
Systemd::Unit[cfssl-ocspserve@cassandra]
Systemd::Unit[cfssl-ocspserve@network_devices]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd]
Cfssl::Ocsp[puppet_rsa]
Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_debmonitor]
File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer]
File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer]
Service[cfssl-multirootca]
Systemd::Syslog[cfssl-ocsprefresh-kafka]
Service[cfssl-ocspserve@dse_front_proxy]
Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)]
Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)]
Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]
File[/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf]
File[/usr/local/bin/prometheus-check-network_devices-certificate-expiry]
Cfssl::Signer[puppet_rsa]
Monitoring::Service[check_certificate_expiry_etcd]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]
Logrotate::Conf[cfssl-ocsprefresh-dse]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux]
File[/etc/sudoers.d/nrpe_certificate_check_etcd]
Systemd::Service[cfssl-ocsprefresh-etcd]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
File[/etc/cfssl/signers/discovery2026/ca/discovery2026.pem]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]
Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_front_proxy_e515778a769f523fb98a7f642670e011]
Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet refresh]
File[/lib/systemd/system/cfssl-ocsprefresh-kafka.timer]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
Cfssl::Signer[discovery2026]
File[/etc/cfssl/signers/wikikube/ca/wikikube-key.pem]
Service[cfssl-ocsprefresh-network_devices.timer]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
File[/etc/cfssl/signers/kafka/cfssl.conf]
File[/etc/cfssl/signers/puppet_rsa/cfssl.conf]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf]
File[/etc/apache2/conf-enabled/50-server-status.conf]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf]
Systemd::Service[cfssl-ocspserve@aux]
File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging_front_proxy.prom]
Systemd::Unit[cfssl-ocspserve@debmonitor]
File[/etc/cfssl/signers/discovery/ca/discovery.pem]
File[/srv/cfssl/bundles/mlserve_staging_front_proxy.pem]
Systemd::Timer::Job[cfssl-ocsprefresh-kafka]
Systemd::Unit[cfssl-ocsprefresh-network_devices.service]
Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]
Systemd::Unit[cfssl-ocspserve@discovery2026]
File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
Profile::Pki::Multirootca::Monitoring[cassandra]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)]
Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
Systemd::Syslog[cfssl-ocsprefresh-discovery2026]
Cfssl::Config[wikikube_staging]
Systemd::Timer[cfssl-ocsprefresh-dse_front_proxy]
File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer]
File[/etc/sudoers.d/nrpe-check_check_cfssl-multirootca_status]
Service[cfssl-ocspserve@mlserve_staging]
Httpd::Conf[server-status]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve]
File[/etc/cfssl/signers/aux/ca/aux-key.pem]
Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet refresh]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
File[/lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service]
Cfssl::Config[network_devices]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)]
Prometheus::Blackbox::Check::Http[PKI_mlserve_front_proxy]
Systemd::Timer[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
Exec[renew certificate - OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
Nrpe::Monitor_service[check_certificate_expiry_cloud_wmnet_ca]
File[/etc/cfssl/ocsp/wikikube_front_proxy.ocsp]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.timer]
File[/etc/cfssl/ocsp/mlserve_front_proxy.ocsp]
File[/srv/cfssl/bundles/wikikube_front_proxy.pem]
File[/etc/logrotate.d/cfssl-ocsprefresh-kafka]
Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service]
File[/lib/systemd/system/cfssl-ocsprefresh-syslog.timer]
Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)]
Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)]
Systemd::Service[cfssl-ocspserve@dse]
File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
Profile::Pki::Multirootca::Monitoring[aux_front_proxy]
Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
File[/etc/sudoers.d/nrpe_certificate_check_syslog]
Systemd::Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service]
Cfssl::Config[aux]
File[/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry]
Sudo::User[nrpe_certificate_check_cassandra]
Prometheus::Node_textfile[prometheus-check-cloud_wmnet_ca-certificate-expiry]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)]
Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf]
Systemd::Syslog[cfssl-ocsprefresh-dse]
Systemd::Timer[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)]
File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux]
File[/lib/systemd/system/cfssl-ocsprefresh-zuul.service]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]
Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_front_proxy_b194b5b9b6c9d6e05b9eed8dcfcc40cf]
File[/etc/cfssl/signers/mlserve/ca]
Service[cfssl-ocsprefresh-zuul.timer]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_syslog]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)]
File[/etc/ferm/conf.d/10_multirootca_tls_termination]
File[/etc/sudoers.d/nrpe_certificate_check_cloud_wmnet_ca]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)]
File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging]
Exec[Generate initial CRL for dse]
Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer]
File[/var/log/cfssl-ocsprefresh-dse_front_proxy]
Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)]
Systemd::Unit[cfssl-ocsprefresh-cassandra.service]
File[/etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg]
Sudo::User[nrpe-check_check_cfssl-multirootca_status]
Cfssl::Ocsp[wikikube_front_proxy]
File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service]
File[/etc/cfssl/signers/zuul/ca]
File[/etc/cfssl/ocsp/aux.ocsp]
File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service]
Sudo::User[nrpe-check_check_certificate_expiry_zuul]
Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]
File[/etc/cfssl/signers/wikikube/ca/wikikube.pem]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.service]
File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem]
File[/etc/cfssl/signers/cloud_wmnet_ca/ca]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)]
File[/etc/cfssl/signers/etcd/cfssl.conf]
File[/etc/cfssl/ocsp/wikikube.ocsp]
Systemd::Service[cfssl-ocsprefresh-cassandra]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)]
Nrpe::Monitor_service[check_certificate_expiry_cassandra]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)]
Nrpe::Check[check_check_certificate_expiry_wikikube]
File[/etc/logrotate.d/cfssl-ocsprefresh-discovery]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.timer]
Systemd::Service[cfssl-ocspserve@cassandra]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
Systemd::Unit[cfssl-ocsprefresh-kafka.timer]
Cfssl::Signer[wikikube_staging_front_proxy]
Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_syslog]
Exec[ensure_present_mod_proxy_http]
File[/etc/cfssl/ocsp/mlserve.ocsp]
Prometheus::Blackbox::Check::Http[PKI_wikikube_staging_front_proxy]
Systemd::Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)]
Profile::Pki::Multirootca::Monitoring[debmonitor]
File[/etc/sudoers.d/nrpe_certificate_check_cassandra]
Systemd::Timer[cfssl-ocsprefresh-network_devices]
Nrpe::Check[check_check_certificate_expiry_cassandra]
Service[cfssl-ocsprefresh-discovery.timer]
File[/etc/cfssl/signers/etcd]
Profile::Pki::Multirootca::Monitoring[puppet_rsa]
Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]
Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet refresh]
Prometheus::Alert::Rule[check_check_certificate_expiry_dse_front_proxy_2560f4f577ba169af651cf96bd5dc1ba]
File[/etc/cfssl/ocsp/puppet_rsa.ocsp]
Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)]
Cfssl::Signer[cassandra]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.timer]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)]
Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
Cfssl::Ocsp[cassandra]
Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem]
File[/etc/sudoers.d/nrpe_certificate_check_kafka]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
Logrotate::Conf[cfssl-ocsprefresh-discovery2026]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)]
File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
Systemd::Syslog[cfssl-ocsprefresh-discovery]
File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
Sudo::User[nrpe-check_check_certificate_expiry_wikikube]
File[/etc/cfssl/signers/mlserve_staging]
Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet]
Exec[renew certificate - OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.timer]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]
File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer]
Systemd::Timer::Job[cfssl-ocsprefresh-etcd]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]
Systemd::Unit[cfssl-ocsprefresh-discovery.service]
Nrpe::Check[check_check_certificate_expiry_discovery]
File[/etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
Exec[renew certificate - OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube]
File[/etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy]
File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging]
Systemd::Unit[cfssl-ocsprefresh-network_devices.timer]
File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.timer]
Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy]
Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_f389c556cebfcfc345b3d6802f320045]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]
Systemd::Unit[cfssl-ocspserve@dse]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
Prometheus::Alert::Rule[check_check_certificate_expiry_etcd_c834f873297e445663ead81279c0b928]
Cfssl::Ocsp[mlserve_front_proxy]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]
Systemd::Timer[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]
Service[cfssl-ocsprefresh-kafka.timer]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]
Service[wmf_auto_restart_apache-htcacheclean.timer]
Rsyslog::Conf[cfssl-gc-expired-certs]
Systemd::Timer::Job[cfssl-gc-expired-certs]
File[/etc/cfssl/ocsp/syslog.ocsp]
Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]
Systemd::Timer[cfssl-ocsprefresh-kafka]
Monitoring::Service[check_certificate_expiry_zuul]
Service[cfssl-ocsprefresh-debmonitor.timer]
File[/etc/cfssl/signers/puppet_rsa/ca]
Prometheus::Blackbox::Check::Http[PKI_mlserve_staging]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)]
Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)]
Prometheus::Blackbox::Check::Http[PKI_discovery]
Systemd::Timer::Job[cfssl-ocsprefresh-mlserve]
Prometheus::Node_textfile[prometheus-check-mlserve_front_proxy-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]
Exec[ensure_present_mod_filter]
Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)]
File[/etc/logrotate.d/cfssl-ocsprefresh-discovery2026]
Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)]
Systemd::Timer[cfssl-ocsprefresh-wikikube_staging]
File[/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf]
Service[nrpe2nodexp-check_cfssl-multirootca_status.timer]
File[/etc/cfssl/signers/wikikube_front_proxy/ca]
Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)]
File[/lib/systemd/system/cfssl-ocsprefresh-syslog.service]
Nrpe::Monitor_service[check_certificate_expiry_aux_front_proxy]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf]
Systemd::Unit[wmf_auto_restart_apache2.timer]
Service[nrpe2nodexp-check_certificate_expiry_wikikube.timer]
Systemd::Unit[cfssl-ocspserve@dse_front_proxy]
Exec[renew certificate - OCSP_wikikube_staging_pki1001_eqiad_wmnet]
Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf]
File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer]
File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem]
Exec[Generate initial CRL for cloud_wmnet_ca]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer]
Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem]
File[/srv/cfssl/bundles/mlserve_staging.pem]
Exec[Generate initial CRL for discovery]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]
Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]
File[/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry]
File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca]
File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
Profile::Pki::Multirootca::Monitoring[dse_front_proxy]
File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service]
File[/lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
File[/etc/cfssl/ocsp/discovery2026.ocsp]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)]
Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]
Sudo::User[nrpe_certificate_check_mlserve_staging]
Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh]
Cfssl::Signer[aux]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)]
Systemd::Unit[cfssl-ocsprefresh-syslog.service]
File[/etc/cfssl/signers/syslog/ca/syslog-key.pem]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]
File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
Nrpe::Check[check_check_certificate_expiry_dse_front_proxy]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_front_proxy.prom]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_etcd]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]
File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)]
File[/etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca]
Cfssl::Ocsp[aux]
Systemd::Syslog[cfssl-ocsprefresh-cloud_wmnet_ca]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)]
Prometheus::Blackbox::Check::Http[PKI_syslog]
Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]
Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]
Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)]
Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf]
File[/srv/cfssl/bundles/etcd.pem]
Rsyslog::Conf[cfssl-ocsprefresh-mlserve_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer]
Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]
File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem]
Systemd::Service[cfssl-ocspserve@kafka]
Systemd::Unit[cfssl-ocsprefresh-etcd.service]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)]
File[/etc/cfssl/ocsp/zuul.ocsp]
Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_debmonitor]
Systemd::Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
Nrpe::Monitor_service[check_certificate_expiry_mlserve_front_proxy]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_zuul]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)]
File[/etc/cfssl/signers/mlserve_front_proxy]
File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem]
File[/lib/systemd/system/cfssl-ocspserve@zuul.service]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
File[/lib/systemd/system/cfssl-multirootca.service]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]
Sudo::User[nrpe_certificate_check_mlserve_staging_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem]
Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)]
File[/srv/cfssl/bundles/aux_front_proxy.pem]
File[/var/log/cfssl-ocsprefresh-wikikube_staging]
File[/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem]
Exec[Generate initial CRL for wikikube_front_proxy]
Rsyslog::Conf[cfssl-ocsprefresh-aux_front_proxy]
Sudo::User[nrpe_certificate_check_wikikube_staging_front_proxy]
Service[cfssl-ocspserve@wikikube_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)]
File[/etc/apache2/mods-enabled/status.conf]
Logrotate::Conf[wmf_auto_restart_apache-htcacheclean]
Logrotate::Conf[cfssl-ocsprefresh-aux]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_cassandra]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux]
Systemd::Unit[cfssl-ocspserve@aux_front_proxy]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-discovery2026.timer]
File[/etc/cfssl/signers/network_devices/ca/network_devices-key.pem]
Prometheus::Node_textfile[prometheus-check-syslog-certificate-expiry]
Nrpe::Check[check_check_certificate_expiry_cloud_wmnet_ca]
File[/srv/cfssl/bundles/puppet_rsa.pem]
Nrpe::Monitor_service[check_certificate_expiry_wikikube_front_proxy]
File[/etc/cfssl/signers/network_devices/ca]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve]
File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_7cff186656c3cabbca85b5b57d0c8679]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.timer]
Node[__node_regexp__pki10012.eqiad.]
Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging_front_proxy]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cassandra]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]
File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
File[/etc/sudoers.d/nrpe_certificate_check_aux]
File[/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
Sudo::User[nrpe-check_check_certificate_expiry_discovery2026]
Service[nrpe2nodexp-check_certificate_expiry_etcd.timer]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]
File[/etc/apache2/conf-available]
Sudo::User[nrpe_certificate_check_network_devices]
Nrpe::Check[check_check_certificate_expiry_mlserve_staging_front_proxy]
File[/usr/local/bin/prometheus-check-aux-certificate-expiry]
Service[cfssl-ocspserve@cloud_wmnet_ca]
File[/srv/cfssl/bundles/debmonitor.pem]
Profile::Pki::Multirootca::Monitoring[wikikube]
File[/etc/cfssl/ocsp/cassandra.ocsp]
File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem]
Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet]
Cfssl::Config[syslog]
File[/etc/cfssl/signers/debmonitor/cfssl.conf]
Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf]
Service[cfssl-ocspserve@syslog]
Service[cfssl-ocspserve@wikikube_staging_front_proxy]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
Systemd::Service[cfssl-ocspserve@puppet_rsa]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
File[/var/log/cfssl-ocsprefresh-puppet_rsa]
Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_debmonitor]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf]
Prometheus::Node_textfile[prometheus-check-cassandra-certificate-expiry]
Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet refresh]
Logrotate::Conf[cfssl-ocsprefresh-syslog]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube.prom]
Motd::Message[pki::multirootca]
Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging_front_proxy]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg]
Cfssl::Config[etcd]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery]
Systemd::Service[cfssl-ocsprefresh-discovery]
Profile::Pki::Multirootca::Monitoring[mlserve]
Motd::Script[pki::multirootca]
Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]
Cfssl::Cert[OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
File[/etc/cfssl/signers/mlserve/cfssl.conf]
Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)]
Profile::Pki::Multirootca::Monitoring[wikikube_staging_front_proxy]
Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging_front_proxy]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]
Systemd::Unit[cfssl-ocspserve@wikikube_staging_front_proxy]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]
File[/usr/local/bin/prometheus-check-kafka-certificate-expiry]
File[/etc/rsyslog.d/40-wmf-auto-restart-apache2.conf]
Exec[Generate initial CRL for mlserve_staging]
File[/etc/cfssl/signers/zuul/ca/zuul.pem]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cassandra]
File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_syslog]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem]
Systemd::Service[cfssl-ocsprefresh-debmonitor]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging]
Cfssl::Cert[OCSP_wikikube_staging_pki1001_eqiad_wmnet]
Exec[Generate initial CRL for aux]
Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf]
Rsyslog::Conf[nrpe2nodexp-check_cfssl-multirootca_status]
Service[cfssl-ocspserve@zuul]
File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
File[/lib/systemd/system/cfssl-gc-expired-certs.service]
Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)]
File[/etc/cfssl/signers/discovery2026]
Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.timer]
Monitoring::Service[check_cfssl-multirootca_status]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
Prometheus::Blackbox::Check::Http[PKI_network_devices]
Cfssl::Cert[OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
Sudo::User[nrpe-check_check_certificate_expiry_syslog]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg]
File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem]
Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_d2a76a31e44e204e2d4788a2698d0e6c]
File[/etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
File[/etc/cfssl/signers/discovery]
File[/etc/update-motd.d/05-pki--multirootca]
File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging.service]
Systemd::Unit[cfssl-ocsprefresh-debmonitor.timer]
Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
Prometheus::Blackbox::Check::Http[PKI_mlserve_staging_front_proxy]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg]
Firewall::Service[csr_and_ocsp_responder]
File[/usr/local/bin/apache-status]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]
Systemd::Service[cfssl-multirootca]
Systemd::Timer[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
File[/srv/cfssl/crl]
File[/etc/cfssl/ocsp/cloud_wmnet_ca.ocsp]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)]
Systemd::Service[cfssl-ocspserve@mlserve_staging]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem]
Prometheus::Blackbox::Check::Http[PKI_aux_front_proxy]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)]
Systemd::Timer[cfssl-ocsprefresh-puppet_rsa]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
Cfssl::Cert[OCSP_mlserve_staging_pki1001_eqiad_wmnet]
Exec[Generate initial CRL for wikikube_staging_front_proxy]
Systemd::Syslog[wmf_auto_restart_apache-htcacheclean]
Systemd::Unit[apache2-apache2-after-network-online-target]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]
Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet]
Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)]
Exec[renew certificate - OCSP_puppet_rsa_pki1001_eqiad_wmnet]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging.prom]
Sudo::User[nrpe-check_check_certificate_expiry_discovery]
File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg]
File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
File[/etc/cfssl/signers/dse/cfssl.conf]
Cfssl::Signer[mlserve_staging]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)]
File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
Prometheus::Blackbox::Check::Http[PKI_wikikube]
Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)]
Systemd::Unit[cfssl-ocsprefresh-dse.service]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf]
Rsyslog::Conf[cfssl-ocsprefresh-aux]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve]
File[/var/log/cfssl-ocsprefresh-mlserve]
Cfssl::Ocsp[network_devices]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]
Nrpe::Check[check_check_certificate_expiry_zuul]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
File[/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry]
File[/etc/cfssl/signers/cassandra/ca/cassandra.pem]
Systemd::Service[cfssl-ocsprefresh-aux_front_proxy]
Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg]
File[/etc/cfssl/signers/etcd/ca]
Class[Role::Pki::Multirootca]
File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem]
Systemd::Timer[cfssl-ocsprefresh-discovery]
File[/usr/local/bin/prometheus-check-wikikube-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)]
Cfssl::Signer[mlserve]
File[/lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service]
Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)]
File[/var/log/cfssl-ocsprefresh-cassandra]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_network_devices]
Ferm::Service[multirootca_tls_termination]
Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.timer]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_debmonitor]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf]
Service[nrpe2nodexp-check_certificate_expiry_syslog.timer]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
File[/etc/logrotate.d/cfssl-ocsprefresh-debmonitor]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service]
Systemd::Service[cfssl-ocsprefresh-zuul]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)]
Systemd::Timer[cfssl-ocsprefresh-aux_front_proxy]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_etcd]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
Service[cfssl-ocspserve@puppet_rsa]
Cfssl::Cert[OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf]
Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging]
File[/srv/cfssl/bundles/discovery2026.pem]
Cfssl::Config[kafka]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]
Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]
Systemd::Unit[cfssl-ocsprefresh-syslog.timer]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service]
File[/lib/systemd/system/cfssl-gc-expired-certs.timer]
Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]
File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
Sudo::User[nrpe-check_check_certificate_expiry_mlserve_front_proxy]
Nrpe::Monitor_service[check_cfssl-multirootca_status]
Prometheus::Node_textfile[prometheus-check-kafka-certificate-expiry]
Cfssl::Config[aux_front_proxy]
Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging]
Service[cfssl-ocsprefresh-wikikube.timer]
Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]
Cfssl::Cert[OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
Nrpe::Monitor_service[check_certificate_expiry_puppet_rsa]
File[/lib/systemd/system/cfssl-ocspserve@debmonitor.service]
Cfssl::Signer[discovery]
Systemd::Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
File[/etc/cfssl/db.conf.json]
Systemd::Service[wmf_auto_restart_apache-htcacheclean]
File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem]
File[/etc/cfssl/signers/discovery2026/ca]
Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
File[/var/log/cfssl-ocsprefresh-etcd]
Service[cfssl-ocspserve@aux]
Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)]
Systemd::Timer::Job[cfssl-ocsprefresh-zuul]
Nrpe::Monitor_service[check_certificate_expiry_debmonitor]
Systemd::Syslog[cfssl-gc-expired-certs]
Monitoring::Service[check_certificate_expiry_puppet_rsa]
File[/srv/cfssl/bundles]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf]
File[/etc/logrotate.d/cfssl-ocsprefresh-syslog]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_network_devices]
Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.timer]
File[/etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp]
File[/etc/apache2/env-available]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer]
File[/etc/sudoers.d/nrpe_certificate_check_wikikube_front_proxy]
Systemd::Unit[cfssl-ocsprefresh-cassandra.timer]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
Rsyslog::Conf[cfssl-ocsprefresh-wikikube]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cassandra.prom]
Systemd::Service[cfssl-ocsprefresh-aux]
Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)]
Systemd::Syslog[cfssl-ocsprefresh-mlserve]
Rsyslog::Conf[cfssl-ocsprefresh-wikikube_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)]
Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]
Cfssl::Config[debmonitor]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]
File[/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service]
Nrpe::Check[check_check_certificate_expiry_discovery2026]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]
Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]
Systemd::Syslog[cfssl-ocsprefresh-aux]
Logrotate::Conf[cfssl-ocsprefresh-debmonitor]
Prometheus::Alert::Rule[check_check_certificate_expiry_cassandra_f5e260f525c48c963fb2e6c86a0d5d63]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Nrpe::Check[check_check_cfssl-multirootca_status]
Systemd::Service[cfssl-ocsprefresh-network_devices]
Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet refresh]
File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf]
Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]
Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]
Cfssl::Ocsp[cloud_wmnet_ca]
File[/etc/apache2/conf-enabled]
Prometheus::Alert::Rule[check_check_certificate_expiry_dse_4384c5ebc49e03dbe331e279fac3f393]
Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service]
Cfssl::Ocsp[wikikube_staging]
File[/etc/ssl/dhparam.pem]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra]
File[/etc/cfssl/signers/puppet_rsa]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem]
Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_front_proxy]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube]
Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
Prometheus::Node_textfile[prometheus-check-aux-certificate-expiry]
Exec[Generate cert puppet_rsa__pki_discovery_wmnet]
Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg]
File[/etc/sudoers.d/nrpe_certificate_check_discovery2026]
File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)]
Systemd::Unit[cfssl-ocspserve@discovery]
Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
Systemd::Syslog[cfssl-ocsprefresh-dse_front_proxy]
Cfssl::Config[mlserve_staging_front_proxy]
File[/etc/cfssl/ocsp/debmonitor.ocsp]
Systemd::Timer[cfssl-ocsprefresh-mlserve_staging]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_kafka.prom]
File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem]
Systemd::Unit[cfssl-ocsprefresh-discovery.timer]
File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem]
File[/etc/cfssl/signers/dse_front_proxy/cfssl.conf]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_network_devices.prom]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]
Nrpe::Monitor_service[check_certificate_expiry_mlserve]
Prometheus::Node_textfile[prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Logrotate::Conf[cfssl-ocsprefresh-network_devices]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]
Prometheus::Node_textfile[prometheus-check-etcd-certificate-expiry]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_kafka]
File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem]
Monitoring::Service[check_certificate_expiry_wikikube]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]
Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.timer]
Httpd::Conf[defaults]
Service[cfssl-ocspserve@kafka]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
File[/etc/logrotate.d/cfssl-ocsprefresh-network_devices]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg]
File[/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf]
File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr]
File[/etc/cfssl/db.conf]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]
Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)]
Logrotate::Conf[cfssl-ocsprefresh-etcd]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf]
File[/etc/cfssl/signers/dse/ca/dse.pem]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor]
Cfssl::Signer[zuul]
Cfssl::Config[wikikube]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf]
Prometheus::Alert::Rule[check_check_certificate_expiry_puppet_rsa_c1b324b3d8ac107f8d7483b4017f5edf]
Prometheus::Blackbox::Check::Http[PKI_mlserve]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem]
Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr]
File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
Systemd::Service[cfssl-ocsprefresh-mlserve_staging]
File[/etc/logrotate.d/cfssl-ocsprefresh-cassandra]
Service[nrpe2nodexp-check_certificate_expiry_cassandra.timer]
Cfssl::Signer[wikikube_front_proxy]
Systemd::Timer[wmf_auto_restart_apache2]
File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem]
Exec[ensure_present_mod_ssl]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)]
Sudo::User[nrpe-check_check_certificate_expiry_wikikube_front_proxy]
Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_front_proxy.prom]
Monitoring::Exported_nagios_service[pki1001 check_cfssl-multirootca_status]
Systemd::Service[cfssl-ocspserve@wikikube]
Nrpe::Monitor_service[check_certificate_expiry_kafka]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf]
File[/etc/logrotate.d/cfssl-ocsprefresh-aux]
File[/var/lib/prometheus/node.d/check_check_cfssl-multirootca_status.prom]
File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf]
File[/etc/apache2/mods-available/status.conf]
Service[cfssl-ocspserve@debmonitor]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.timer]
File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.service]
Cfssl::Ocsp[debmonitor]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem]
Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
Cfssl::Signer[wikikube_staging]
Systemd::Syslog[cfssl-ocsprefresh-zuul]
Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem]
Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
File[/etc/apache2/sites-available]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
Systemd::Service[cfssl-ocspserve@debmonitor]
Cfssl::Cert[OCSP_network_devices_pki1001_eqiad_wmnet]
File[/etc/cfssl/signers/kafka/ca]
File[/etc/cfssl/ocsp/network_devices.ocsp]
Service[cfssl-ocsprefresh-wikikube_front_proxy.timer]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem]
Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
File[/etc/sudoers.d/nrpe_certificate_check_wikikube]
Exec[renew certificate - OCSP_syslog_pki1001_eqiad_wmnet]
File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr]
Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom]
Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
Logrotate::Conf[cfssl-ocsprefresh-wikikube_front_proxy]
File[/etc/cfssl/signers/dse_front_proxy]
Service[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]
Service[cfssl-ocsprefresh-dse.timer]
Systemd::Service[cfssl-ocspserve@etcd]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-dse.timer]
Prometheus::Blackbox::Check::Http[PKI_zuul]
Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet refresh]
File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
Cfssl::Ocsp[mlserve_staging]
Nrpe::Monitor_service[check_certificate_expiry_aux]
File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_zuul]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]
Systemd::Service[cfssl-ocspserve@mlserve_staging_front_proxy]
File[/etc/cfssl/signers/mlserve/ca/mlserve-key.pem]
Systemd::Unit[cfssl-ocsprefresh-wikikube.service]
File[/srv/cfssl/bundles/dse.pem]
File[/etc/apache2/conf-enabled/50-cfssl-issuer-k8s-pods-vhost-port.conf]
File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]
Monitoring::Service[check_certificate_expiry_mlserve_staging]
File[/etc/logrotate.d/wmf_auto_restart_apache-htcacheclean]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
Exec[renew certificate - OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
Prometheus::Alert::Rule[check_check_certificate_expiry_aux_front_proxy_99cf4f8f014e8fd527800abcc213f494]
Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)]
Logrotate::Conf[cfssl-ocsprefresh-zuul]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_kafka]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg]
Systemd::Timer::Job[cfssl-ocsprefresh-wikikube]
Service[apache2]
Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet]
Systemd::Unit[cfssl-ocspserve@mlserve_front_proxy]
Systemd::Service[cfssl-ocsprefresh-cloud_wmnet_ca]
Systemd::Timer::Job[cfssl-ocsprefresh-aux]
Logrotate::Conf[cfssl-ocsprefresh-dse_front_proxy]
Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging]
Systemd::Timer[cfssl-ocsprefresh-mlserve]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca]
File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cassandra]
File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]
Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf]
File_line[auto_restart_file_presence_apache-htcacheclean]
File[/srv/cfssl/bundles/wikikube_staging_front_proxy.pem]
Exec[Generate initial CRL for debmonitor]
Service[cfssl-ocspserve@wikikube]
File[/lib/systemd/system/cfssl-ocspserve@discovery2026.service]
File[/srv/cfssl/bundles/mlserve_front_proxy.pem]
Systemd::Service[cfssl-ocspserve@cloud_wmnet_ca]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
Firewall::Service[multirootca tls termination]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]
Profile::Pki::Multirootca::Monitoring[discovery]
Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service]
File[/etc/logrotate.d/cfssl-ocsprefresh-dse]
Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery2026.prom]
Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry]
File[/etc/cfssl/signers/cassandra/ca]
Cfssl::Ocsp[wikikube]
Prometheus::Node_textfile[prometheus-check-discovery2026-certificate-expiry]
Systemd::Unit[cfssl-ocspserve@etcd]
File[/etc/cfssl/signers/discovery/cfssl.conf]
Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet]
Prometheus::Node_textfile[prometheus-check-dse_front_proxy-certificate-expiry]
Sudo::User[nrpe-check_check_certificate_expiry_mlserve]
Sudo::User[nrpe-check_check_certificate_expiry_dse]
File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
File[/usr/local/bin/prometheus-check-cassandra-certificate-expiry]
Cfssl::Signer[dse]
Package[apache2]
Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]
File[/etc/cfssl/ocsp/etcd.ocsp]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_etcd]
File[/lib/systemd/system/cfssl-ocsprefresh-dse.service]
Prometheus::Node_textfile[prometheus-check-dse-certificate-expiry]
Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]
File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
Systemd::Syslog[cfssl-ocsprefresh-wikikube]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)]
File[/etc/cfssl/signers/wikikube_staging/ca]
File[/lib/systemd/system/cfssl-ocsprefresh-aux.service]
Nrpe::Check[check_check_certificate_expiry_aux]
Exec[renew certificate - OCSP_network_devices_pki1001_eqiad_wmnet]
File[/etc/apache2/sites-available/00-dummy.conf]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
Systemd::Unit[cfssl-ocspserve@wikikube]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]
Monitoring::Service[check_certificate_expiry_mlserve_front_proxy]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_syslog]
File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr]
Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service]
File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
Systemd::Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging_front_proxy]
File[/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.timer]
Httpd::Mod_conf[ssl]
Systemd::Unit[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_puppet_rsa]
Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)]
Cfssl::Ocsp[discovery]
Nrpe::Check[check_check_certificate_expiry_dse]
Prometheus::Alert::Rule[check_check_certificate_expiry_cloud_wmnet_ca_f87f54115f2f782169eed72541c30a1e]
Systemd::Timer::Job[cfssl-ocsprefresh-dse]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
File[/etc/cfssl/signers/kafka/ca/kafka.pem]
Sudo::User[nrpe_certificate_check_debmonitor]
Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]
Service[cfssl-ocsprefresh-mlserve.timer]
Httpd::Mod_conf[proxy_http]
File[/srv/cfssl/bundles/kafka.pem]
Cfssl::Ocsp[etcd]
File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
Exec[Generate initial CRL for aux_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf]
File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
Prometheus::Node_textfile[prometheus-check-wikikube-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)]
File[/etc/cfssl/signers/discovery2026/cfssl.conf]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging_front_proxy.prom]
Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]
Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf]
Profile::Pki::Multirootca::Monitoring[network_devices]
File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]
Systemd::Timer[cfssl-ocsprefresh-discovery2026]
Cfssl::Ocsp[syslog]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
Systemd::Timer[cfssl-ocsprefresh-wikikube_front_proxy]
Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.timer]
Systemd::Unit[cfssl-ocspserve@zuul]
Service[cfssl-ocsprefresh-cassandra.timer]
Prometheus::Node_textfile[prometheus-check-puppet_rsa-certificate-expiry]
File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service]
Exec[Generate initial CRL for discovery2026]
Sudo::User[nrpe-check_check_certificate_expiry_kafka]
Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]
File[/lib/systemd/system/cfssl-ocspserve@discovery.service]
Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]
Cfssl::Cert[OCSP_aux_pki1001_eqiad_wmnet]
Systemd::Unit[cfssl-ocspserve@mlserve_staging]
File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
Cfssl::Cert[OCSP_cassandra_pki1001_eqiad_wmnet]
Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh]
Sudo::User[nrpe-check_check_certificate_expiry_dse_front_proxy]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)]
Cfssl::Config[wikikube_front_proxy]
Exec[Generate initial CRL for mlserve_front_proxy]
Prometheus::Node_textfile[prometheus-check-mlserve-certificate-expiry]
Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
Systemd::Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]
File[/etc/sudoers.d/nrpe_certificate_check_aux_front_proxy]
File[/etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)]
Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve.prom]
Service[nrpe2nodexp-check_certificate_expiry_aux.timer]
File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service]
Rsyslog::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging_front_proxy]
Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]
Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]
Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service]
Nrpe::Check[check_check_certificate_expiry_puppet_rsa]
Systemd::Service[cfssl-ocsprefresh-kafka]
Sudo::User[nrpe_certificate_check_dse_front_proxy]
Cfssl::Db[multirootca-db]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_debmonitor]
File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service]
Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]
Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]
Package[python3-pymysql]
File[/etc/logrotate.d/cfssl-ocsprefresh-zuul]
Exec[renew certificate - OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem]
Prometheus::Alert::Rule[check_check_certificate_expiry_network_devices_21dac3775d059b8c991626e2ca33f951]
File[/var/log/cfssl-ocsprefresh-discovery]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy]
Logrotate::Conf[cfssl-ocsprefresh-mlserve_front_proxy]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)]
Monitoring::Service[check_certificate_expiry_kafka]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery2026]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)]
File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf]
File[/etc/sudoers.d/nrpe_certificate_check_zuul]
File[/etc/cfssl/signers/cloud_wmnet_ca]
Systemd::Service[cfssl-ocsprefresh-syslog]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Monitoring::Service[check_certificate_expiry_cassandra]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
Nrpe::Check[check_check_certificate_expiry_mlserve_front_proxy]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse_front_proxy]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]
File[/etc/apache2/sites-enabled/00-dummy.conf]
Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service]
Systemd::Syslog[cfssl-ocsprefresh-etcd]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery2026]
File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf]
Prometheus::Alert::Rule[check_check_certificate_expiry_kafka_22922fd6bc2d570e018cbe5ccd8d1727]
Service[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]
Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]
Sudo::User[nrpe-check_check_certificate_expiry_cassandra]
Monitoring::Service[check_certificate_expiry_network_devices]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem]
Systemd::Service[cfssl-ocsprefresh-discovery2026]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service]
File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca]
File[/srv/cfssl]
Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging_front_proxy]
Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)]
File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.timer]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)]
File[/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging]
Augeas[Apache2 logs]
Systemd::Timer::Job[cfssl-ocsprefresh-network_devices]
File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_network_devices]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cloud_wmnet_ca.prom]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]
File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem]
File[/etc/cfssl/signers/syslog]
Rsyslog::Conf[cfssl-ocsprefresh-mlserve]
Httpd::Site[dummy]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]
File[/etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp]
File[/srv/cfssl/bundles/aux.pem]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery]
Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_front_proxy]
Systemd::Timer[nrpe2nodexp-check_cfssl-multirootca_status]
Service[wmf_auto_restart_apache2.timer]
File[/etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa]
Prometheus::Blackbox::Check::Http[PKI_cassandra]
File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem]
File[/var/log/cfssl-ocsprefresh-network_devices]
File[/lib/systemd/system/cfssl-ocsprefresh-aux.timer]
File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem]
Exec[renew certificate - OCSP_aux_pki1001_eqiad_wmnet]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Sudo::User[nrpe_certificate_check_aux]
Profile::Pki::Multirootca::Monitoring[mlserve_staging_front_proxy]
Rsyslog::Conf[cfssl-ocsprefresh-network_devices]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)]
Systemd::Syslog[cfssl-ocsprefresh-cassandra]
Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]
Systemd::Service[cfssl-gc-expired-certs]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf]
Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve]
Nrpe::Monitor_service[check_certificate_expiry_dse_front_proxy]
File[/lib/systemd/system/cfssl-ocspserve@etcd.service]
Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]
Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.timer]
Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet]
Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet refresh]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)]
Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem]
Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_bfd2f7c6497e1da6323bef48d24f9e8e]
File[/etc/cfssl/signers/aux_front_proxy/ca]
File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_network_devices]
Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]
File[/var/log/cfssl-gc-expired-certs]
Profile::Pki::Multirootca::Monitoring[syslog]
Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)]
Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]
Exec[Generate initial CRL for etcd]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)]
Logrotate::Conf[cfssl-ocsprefresh-wikikube]
File[/lib/systemd/system/cfssl-ocsprefresh-zuul.timer]
File[/srv/cfssl/bundles/cassandra.pem]
Exec[Generate initial CRL for wikikube_staging]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]
Nrpe::Monitor_service[check_certificate_expiry_etcd]
Systemd::Timer[cfssl-ocsprefresh-zuul]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service]
File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]
Service[cfssl-ocsprefresh-aux.timer]
File[/etc/sudoers.d/nrpe_certificate_check_discovery]
Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet]
Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet refresh]
Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]
Service[cfssl-ocspserve@wikikube_staging]
Cfssl::Config[dse]
File[/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
Sudo::User[nrpe-check_check_certificate_expiry_network_devices]
Logrotate::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]
File[/lib/systemd/system/cfssl-ocsprefresh-dse.timer]
File[/etc/cfssl/signers/network_devices/ca/network_devices.pem]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.timer]
Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet refresh]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]
Systemd::Timer::Job[cfssl-ocsprefresh-cassandra]
File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]
Service[cfssl-ocspserve@aux_front_proxy]
File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging.service]
Cfssl::Signer[network_devices]
Prometheus::Alert::Rule[check_check_certificate_expiry_zuul_373325faaa689f3e9b058d91d4eb6cdb]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_etcd]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux]
Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet refresh]
Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]
Systemd::Unit[cfssl-ocsprefresh-zuul.timer]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]
Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca]
Prometheus::Node_textfile[prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery2026]
Cfssl::Config[discovery2026]
Exec[renew certificate - OCSP_kafka_pki1001_eqiad_wmnet]
File[/lib/systemd/system/cfssl-ocspserve@syslog.service]
Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)]
Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy]
Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging]
Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service]
Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]
Rsyslog::Conf[cfssl-ocsprefresh-etcd]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_etcd.prom]
Service[nrpe2nodexp-check_certificate_expiry_kafka.timer]
Rsyslog::Conf[cfssl-ocsprefresh-discovery]
Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor]
Prometheus::Node_textfile[prometheus-check-wikikube_staging-certificate-expiry]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery2026]
Systemd::Unit[cfssl-ocsprefresh-debmonitor.service]
Cfssl::Signer[dse_front_proxy]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube]
Systemd::Service[cfssl-ocspserve@discovery2026]
Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]
Exec[Generate initial CRL for mlserve_staging_front_proxy]
File[/usr/local/sbin/cfssl-ocsprefresh]
File[/etc/cfssl/signers/aux_front_proxy/cfssl.conf]
Profile::Pki::Multirootca::Monitoring[cloud_wmnet_ca]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service]
Sudo::User[nrpe_certificate_check_wikikube]
Service[cfssl-ocsprefresh-mlserve_front_proxy.timer]
File[/etc/cfssl/multiroot.conf]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf]
File[/etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf]
Systemd::Unit[cfssl-ocsprefresh-aux.timer]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
Monitoring::Service[check_certificate_expiry_syslog]
File[/etc/cfssl/signers/mlserve/ca/mlserve.pem]
Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service]
Prometheus::Blackbox::Check::Http[PKI_wikikube_staging]
Systemd::Unit[cfssl-ocsprefresh-kafka.service]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]
Exec[Generate initial CRL for network_devices]
File[/etc/cfssl/signers/mlserve_staging_front_proxy]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]
Systemd::Service[cfssl-ocspserve@zuul]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]
Systemd::Timer[cfssl-ocsprefresh-aux]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]
Systemd::Unit[cfssl-ocspserve@puppet_rsa]
Prometheus::Blackbox::Check::Http[PKI_etcd]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse]
Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.timer]
File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer]
Cfssl::Config[cassandra]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg]
File[/etc/sudoers.d/nrpe_certificate_check_dse_front_proxy]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cassandra]
File[/etc/cfssl/signers/dse/ca]
Systemd::Service[cfssl-ocspserve@dse_front_proxy]
Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet]
Systemd::Timer[cfssl-gc-expired-certs]
Cfssl::Signer[mlserve_staging_front_proxy]
Systemd::Service[cfssl-ocspserve@aux_front_proxy]
Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
Logrotate::Conf[cfssl-ocsprefresh-cassandra]
Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)]
File[/lib/systemd/system/cfssl-ocspserve@aux.service]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]
Cfssl::Signer[debmonitor]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_debmonitor.prom]
File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem]
Prometheus::Node_textfile[prometheus-check-mlserve_staging-certificate-expiry]
Systemd::Unit[cfssl-gc-expired-certs.service]
Nrpe::Check[check_check_certificate_expiry_wikikube_staging_front_proxy]
File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)]
Systemd::Timer[cfssl-ocsprefresh-cloud_wmnet_ca]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]
Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)]
Systemd::Service[cfssl-ocsprefresh-wikikube_staging_front_proxy]
Systemd::Timer[cfssl-ocsprefresh-mlserve_staging_front_proxy]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf]
File[/etc/cfssl/signers/wikikube_staging_front_proxy]
Ferm::Service[csr_and_ocsp_responder]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]
File[/lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service]
Exec[renew certificate - puppet_rsa__pki_discovery_wmnet]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery2026]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf]
File[/etc/cfssl/signers/zuul/ca/zuul-key.pem]
File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]
File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem]
File[/lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service]
Sudo::User[nrpe-check_check_certificate_expiry_etcd]
Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)]
Cfssl::Ocsp[dse]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.timer]
Systemd::Timer[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
Systemd::Timer[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
Systemd::Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_front_proxy_4d759acaf0fd7dd3abaa03dc4565aef6]
Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]
File[/etc/cfssl/signers/etcd/ca/etcd.pem]
File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem]
Exec[Generate initial CRL for syslog]
Logrotate::Conf[cfssl-gc-expired-certs]
Prometheus::Node_textfile[prometheus-check-wikikube_front_proxy-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)]
File[/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry]
File[/srv/cfssl/bundles/cloud_wmnet_ca.pem]
File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
Prometheus::Blackbox::Check::Http[PKI_cloud_wmnet_ca]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf]
Exec[Generate initial CRL for kafka]
Nrpe::Monitor_service[check_certificate_expiry_zuul]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)]
Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]
Logrotate::Conf[cfssl-ocsprefresh-discovery]
File[/var/log/cfssl-ocsprefresh-zuul]
File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr]
File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.service]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa]
Systemd::Syslog[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
Nrpe::Check[check_check_certificate_expiry_syslog]
File[/lib/systemd/system/cfssl-ocsprefresh-kafka.service]
Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer]
Systemd::Timer[cfssl-ocsprefresh-wikikube]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)]
File[/etc/cfssl/signers/kafka]
Prometheus::Node_textfile[prometheus-check-network_devices-certificate-expiry]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]
File[/srv/cfssl/bundles/network_devices.pem]
File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]
Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)]
File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer]
Systemd::Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf]
Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)]
Httpd::Conf[cfssl-issuer-k8s-pods-vhost-port]
Class[Httpd]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg]
Cfssl::Ocsp[wikikube_staging_front_proxy]
Systemd::Syslog[cfssl-ocsprefresh-debmonitor]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf]
Cfssl::Ocsp[Wikimedia_Internal_Root_CA]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service]
File[/etc/sudoers.d/nrpe_certificate_check_mlserve]
Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]
Systemd::Timer::Job[nrpe2nodexp-check_cfssl-multirootca_status]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]
Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]
File[/etc/logrotate.d/cfssl-gc-expired-certs]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]
Service[cfssl-ocsprefresh-syslog.timer]
Service[cfssl-ocsprefresh-discovery2026.timer]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf]
Systemd::Unit[cfssl-ocspserve@syslog]
File[/etc/cfssl/signers/zuul/cfssl.conf]
Systemd::Service[cfssl-ocspserve@wikikube_front_proxy]
Systemd::Unit[cfssl-ocsprefresh-mlserve.timer]
Service[cfssl-ocsprefresh-mlserve_staging.timer]
File[/srv/cfssl/bundles/syslog.pem]
Prometheus::Blackbox::Check::Http[PKI_dse]
File[/etc/cfssl/ocsp/kafka.ocsp]
Rsyslog::Conf[cfssl-ocsprefresh-dse_front_proxy]
Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.timer]
Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service]
Systemd::Service[cfssl-ocspserve@mlserve]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cloud_wmnet_ca]
Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet refresh]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
Systemd::Timer[cfssl-ocsprefresh-cassandra]
Sudo::User[nrpe_certificate_check_discovery2026]
File[/usr/local/bin/prometheus-check-syslog-certificate-expiry]
File[/etc/cfssl/ocsp/aux_front_proxy.ocsp]
Systemd::Service[cfssl-ocspserve@mlserve_front_proxy]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]
Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet refresh]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf]
Systemd::Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
File[/srv/cfssl/bundles/dse_front_proxy.pem]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_kafka]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem]
Systemd::Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
Systemd::Syslog[wmf_auto_restart_apache2]
Systemd::Service[cfssl-ocsprefresh-mlserve_front_proxy]
Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging]
File[/etc/cfssl/signers/aux_front_proxy]
Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)]
File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
File[/etc/ssl/localcerts/multiroot_ca.pem]
File[/lib/systemd/system/cfssl-ocspserve@mlserve.service]
Systemd::Unit[cfssl-ocspserve@wikikube_staging]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer]
Prometheus::Alert::Rule[check_check_certificate_expiry_debmonitor_224e2ac3574a9ce482218106d95a2931]
File[/etc/apache2/conf-available/00-defaults.conf]
Exec[apache2_test_config_and_restart]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)]
Systemd::Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
File[/etc/cfssl/signers/kafka/ca/kafka-key.pem]
Prometheus::Alert::Rule[check_check_cfssl-multirootca_status_52832284a5fb8b8ea6f55bb6271912c9]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
Logrotate::Conf[wmf_auto_restart_apache2]
Cfssl::Ocsp[discovery2026]
Prometheus::Node_textfile[prometheus-check-zuul-certificate-expiry]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service]
Systemd::Unit[cfssl-ocspserve@mlserve_staging_front_proxy]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]
Sudo::User[nrpe_certificate_check_aux_front_proxy]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]
File[/lib/systemd/system/cfssl-ocspserve@cassandra.service]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)]
Httpd::Mod_conf[status]
Prometheus::Node_textfile[prometheus-check-aux_front_proxy-certificate-expiry]
Cfssl::Config[mlserve]
Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]
File[/var/log/cfssl-ocsprefresh-dse]
Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)]
Nrpe::Monitor_service[check_certificate_expiry_syslog]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube]
Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]
Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet refresh]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_syslog.prom]
Systemd::Service[cfssl-ocsprefresh-wikikube_staging]
File[/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf]
Systemd::Service[cfssl-ocsprefresh-dse_front_proxy]
Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)]
File[/usr/local/sbin/cfssl-certs]
Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf]
Cfssl::Cert[OCSP_discovery_pki1001_eqiad_wmnet]
File[/usr/local/bin/prometheus-check-debmonitor-certificate-expiry]
File[/lib/systemd/system/cfssl-ocsprefresh-etcd.service]
File[/var/log/cfssl-ocsprefresh-mlserve_staging]
Firewall::Service[multirootca-tls-termination-for-cfssl-issuer-k8s-pods]
Systemd::Syslog[cfssl-ocsprefresh-network_devices]
Systemd::Unit[cfssl-ocspserve@kafka]
Cfssl::Ocsp[aux_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)]
Systemd::Service[nrpe2nodexp-check_cfssl-multirootca_status]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer]
Prometheus::Blackbox::Check::Http[PKI_aux]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux.prom]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf]
Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_zuul]
Cfssl::Signer[mlserve_front_proxy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)]
Systemd::Unit[cfssl-ocspserve@wikikube_front_proxy]
Sudo::User[nrpe_certificate_check_cloud_wmnet_ca]
Nrpe::Monitor_service[check_certificate_expiry_wikikube]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
Monitoring::Service[check_certificate_expiry_mlserve]
Cfssl::Cert[OCSP_etcd_pki1001_eqiad_wmnet]
File[/lib/systemd/system/wmf_auto_restart_apache2.service]
Systemd::Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
Systemd::Service[cfssl-ocspserve@wikikube_staging_front_proxy]
File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]
Monitoring::Service[check_certificate_expiry_wikikube_staging]
Rsyslog::Conf[cfssl-ocsprefresh-debmonitor]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf]
Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)]
Sudo::User[nrpe_certificate_check_etcd]
File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.service]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf]
File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
Cfssl::Cert[OCSP_discovery2026_pki1001_eqiad_wmnet]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse.prom]
Systemd::Timer[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy]
Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
Systemd::Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
Cfssl::Config[mlserve_front_proxy]
Cfssl::Signer[kafka]
File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem]
File[/etc/cfssl/signers/mlserve]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube]
File[/usr/local/bin/prometheus-check-dse-certificate-expiry]
File[/etc/sudoers.d/nrpe_certificate_check_dse]
Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]
Profile::Pki::Multirootca::Monitoring[wikikube_staging]
Ferm::Service[multirootca_tls_termination_for_cfssl_issuer_k8s_pods]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg]
File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr]
Exec[renew certificate - OCSP_discovery_pki1001_eqiad_wmnet]
Httpd::Conf[dummy]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service]
Systemd::Unit[cfssl-ocspserve@cloud_wmnet_ca]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_etcd]
Profile::Pki::Multirootca::Monitoring[discovery2026]
File[/etc/cfssl/signers/wikikube/ca]
File[/lib/systemd/system/wmf_auto_restart_apache2.timer]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service]
Cfssl::Cert[OCSP_zuul_pki1001_eqiad_wmnet]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service]
File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer]
Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service]
Exec[Generate initial CRL for puppet_rsa]
File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf]
File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]
Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]
Cfssl::Signer[cloud_wmnet_ca]
File[/usr/local/bin/prometheus-check-mlserve-certificate-expiry]
Logrotate::Conf[cfssl-ocsprefresh-kafka]
Systemd::Service[wmf_auto_restart_apache2]
Service[cfssl-ocsprefresh-aux_front_proxy.timer]
File[/srv/cfssl/bundles/wikikube_staging.pem]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
File[/etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf]
Service[cfssl-ocspserve@dse]
Systemd::Service[cfssl-ocspserve@wikikube_staging]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service]
Systemd::Timer::Job[cfssl-ocsprefresh-syslog]
File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
Profile::Pki::Multirootca::Monitoring[kafka]
Cfssl::Config[puppet_rsa]
Nrpe::Check[check_check_certificate_expiry_etcd]
Systemd::Unit[cfssl-ocsprefresh-mlserve.service]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service]
Systemd::Timer[cfssl-ocsprefresh-mlserve_front_proxy]
Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.timer]
File[/etc/cfssl/signers/network_devices/cfssl.conf]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
File[/var/log/cfssl-ocsprefresh-debmonitor]
Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]
Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)]
Systemd::Service[cfssl-ocsprefresh-mlserve]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
Service[nrpe2nodexp-check_certificate_expiry_network_devices.timer]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg]
Service[nrpe2nodexp-check_certificate_expiry_zuul.timer]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)]
Rsyslog::Conf[cfssl-ocsprefresh-zuul]
Exec[renew certificate - OCSP_discovery2026_pki1001_eqiad_wmnet]
Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)]
Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Cfssl::Config[cloud_wmnet_ca]
File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem]
Monitoring::Service[check_certificate_expiry_debmonitor]
File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem]
File[/etc/cfssl/ocsp/discovery.ocsp]
Httpd::Mod_conf[headers]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]
File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem]
File[/etc/cfssl/signers/syslog/ca]
Service[cfssl-ocsprefresh-dse_front_proxy.timer]
Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.service]
Nrpe::Check[check_check_certificate_expiry_mlserve_staging]
Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]
Cfssl::Cert[OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy]
File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
Sudo::User[nrpe_certificate_check_mlserve]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_puppet_rsa]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]
File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
Service[cfssl-ocspserve@cassandra]
Monitoring::Service[check_certificate_expiry_discovery2026]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
Sudo::User[nrpe_certificate_check_wikikube_front_proxy]
Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
Service[cfssl-ocsprefresh-etcd.timer]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]
Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]
Systemd::Service[nrpe2nodexp-check_certificate_expiry_syslog]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]
File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]
Profile::Pki::Multirootca::Monitoring[mlserve_staging]
Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]
File[/etc/cfssl/signers/mlserve_staging/ca]
File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]
Sudo::User[nrpe_certificate_check_puppet_rsa]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_network_devices]
Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet refresh]
Systemd::Timer[cfssl-ocsprefresh-wikikube_staging_front_proxy]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices]
Systemd::Syslog[cfssl-ocsprefresh-aux_front_proxy]
Cfssl::Cert[OCSP_wikikube_pki1001_eqiad_wmnet]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf]
Rsyslog::Conf[cfssl-ocsprefresh-kafka]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]
File[/etc/cfssl/signers/aux/cfssl.conf]
File[/etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods]
Exec[renew certificate - OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
Prometheus::Node_textfile[prometheus-check-debmonitor-certificate-expiry]
Sudo::User[nrpe-check_check_certificate_expiry_aux_front_proxy]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve]
Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]
Service[cfssl-ocspserve@discovery]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging]
Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_front_proxy_9d6dd05c8e5e1bb294462d932b24bd1a]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]
Systemd::Unit[wmf_auto_restart_apache-htcacheclean.timer]
File[/etc/cfssl/ocsp/mlserve_staging.ocsp]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service]
Logrotate::Conf[cfssl-ocsprefresh-puppet_rsa]
File[/etc/cfssl/signers/cassandra/ca/cassandra-key.pem]
Prometheus::Blackbox::Check::Http[PKI_dse_front_proxy]
Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)]
Monitoring::Service[check_certificate_expiry_wikikube_front_proxy]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux_front_proxy]
Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
Systemd::Timer[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
Monitoring::Service[check_certificate_expiry_dse]
Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]
File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]
Profile::Pki::Multirootca::Monitoring[zuul]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service]
Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]
Systemd::Timer[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem]
Cfssl::Config[discovery]
Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]
Rsyslog::Conf[wmf_auto_restart_apache2]
File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy]
Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026]
Cfssl::Cert[OCSP_kafka_pki1001_eqiad_wmnet]
Monitoring::Service[check_certificate_expiry_discovery]
Service[cfssl-ocspserve@mlserve]
Profile::Pki::Multirootca::Monitoring[wikikube_front_proxy]
Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)]
File[/etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg]
Cfssl::Signer[syslog]
Prometheus::Blackbox::Check::Http[PKI_debmonitor]
File[/etc/cfssl/signers/cassandra]
Service[cfssl-ocsprefresh-puppet_rsa.timer]
File[/etc/cfssl/signers/dse]
Systemd::Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer]
Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)]
File[/etc/cfssl/signers/mlserve_staging/cfssl.conf]
Systemd::Unit[cfssl-gc-expired-certs.timer]
Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)]
File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service]
File[/srv/cfssl/bundles/wikikube.pem]
File[/var/log/cfssl-ocsprefresh-syslog]
Sudo::User[nrpe_certificate_check_syslog]
Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
Nrpe::Check[check_check_certificate_expiry_wikikube_front_proxy]
File[/etc/apache2/sites-enabled]
File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer]
File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet refresh]
Nrpe::Check[check_check_certificate_expiry_kafka]
Systemd::Timer[nrpe2nodexp-check_certificate_expiry_zuul]
Cfssl::Cert[OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
Service[cfssl-ocspserve@mlserve_staging_front_proxy]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]
File[/etc/apache2/sites-enabled/50-pki-discovery-wmnet.conf]
Systemd::Syslog[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer]
Rsyslog::Conf[cfssl-ocsprefresh-puppet_rsa]
Exec[ensure_present_mod_headers]
File[/etc/logrotate.d/cfssl-ocsprefresh-etcd]
Systemd::Timer::Job[wmf_auto_restart_apache-htcacheclean]
Prometheus::Alert::Rule[check_check_certificate_expiry_syslog_e3b9b989d5062ce2d267023dfe42fcd8]
Nrpe::Check[check_check_certificate_expiry_network_devices]
Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse]
File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf]
Exec[ensure_present_mod_status]
File[/etc/rsyslog.d/40-cfssl-gc-expired-certs.conf]
Systemd::Service[cfssl-ocspserve@network_devices]
File[/etc/ferm/conf.d/10_csr_and_ocsp_responder]
Exec[renew certificate - OCSP_cassandra_pki1001_eqiad_wmnet]
File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem]
File[/var/log/cfssl-ocsprefresh-discovery2026]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
Systemd::Timer::Job[wmf_auto_restart_apache2]
Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)]
Httpd::Mod_conf[filter]
File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging.prom]
File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem]
Service[nrpe2nodexp-check_certificate_expiry_dse.timer]
Cfssl::Cert[puppet_rsa__pki_discovery_wmnet]
Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]
File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service]
Systemd::Timer[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]
File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer]
File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf]
File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service]
File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
File[/etc/cfssl/signers/dse_front_proxy/ca]
File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery]
Rsyslog::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]
File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf]
Systemd::Syslog[cfssl-ocsprefresh-mlserve_front_proxy]
File[/var/log/wmf_auto_restart_apache-htcacheclean]
Systemd::Unit[cfssl-ocsprefresh-zuul.service]
Prometheus::Alert::Rule[check_check_certificate_expiry_aux_f7dfe9e2cd77303dfae7ae11c5c56d90]
File[/etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf]

Resources modified

Logrotate::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    ensure => present

Rsyslog::Conf[cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-discovery2026].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-discovery2026]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-discovery2026]
-    ensure   => present
-    priority => 40

Cfssl::Ocsp[mlserve_staging_front_proxy]

Parameters differences:

--- Cfssl::Ocsp[mlserve_staging_front_proxy].orig
+++ Cfssl::Ocsp[mlserve_staging_front_proxy]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 20041
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_discovery2026.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/var/log/wmf_auto_restart_apache2]

Parameters differences:

--- File[/var/log/wmf_auto_restart_apache2].orig
+++ File[/var/log/wmf_auto_restart_apache2]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/usr/local/bin/prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-zuul-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-zuul-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    ensure => present

File[/etc/cfssl/signers/aux/ca/aux.pem]

Parameters differences:

--- File[/etc/cfssl/signers/aux/ca/aux.pem].orig
+++ File[/etc/cfssl/signers/aux/ca/aux.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/aux/ca/aux.pem.orig
+++ /etc/cfssl/signers/aux/ca/aux.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpjCCAwegAwIBAgIUB83dKT9lbMGOLf38Jx6fmsSa714wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjBx
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQwwCgYDVQQDEwNhdXgwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABADhzJSO
-h264ltJ1CVADYcfi1rIxQOY3gtAsxonZ6CWNueKg0vjvDeL32l+NZ3f2yj2CIzl5
-sa6sZjXmwAKziuuvCAHmsZDY5gzgBdwhZ6UeGAbwlLMgQajwRvCA2RUMuH8iAd6o
-QcfZyHQFb0zl9mCHYNkjLT4jpwrL4Lx/DGbmkE/ulqOCAQwwggEIMA4GA1UdDwEB
-/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSPVQ8kSyOIH5l4
-1mVGCudJoaowtTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
-BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
-bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
-oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
-bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCALJuWafVNInsE4Q8
-tEHYHqhweF6bEArm7d3dqqTjKHuOcrmhXo4rgX5VsXHtI3qq9XGHoik6JUSwgftV
-Sr+GWrIZAkIAuqmJ5vv2LgFcJWvYDkIPH9HXB9rIwAUHPFJ/iX2Ig9By+ss8nJbU
-A3Ml/4NKRsXZwwyScmowVWQHfMpv53BsBv8=
------END CERTIFICATE-----

Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa -profile ocsp /etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet

File[/var/log/cfssl-ocsprefresh-aux]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-aux].orig
+++ File[/var/log/cfssl-ocsprefresh-aux]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Nrpe::Plugin[check_systemd_unit_status]

Parameters differences:

--- Nrpe::Plugin[check_systemd_unit_status].orig
+++ Nrpe::Plugin[check_systemd_unit_status]

-    source => puppet:///modules/systemd/check_systemd_unit_status
-    ensure => present

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Rsyslog::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca]
-    ensure   => present
-    priority => 40

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_dse.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_dse]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem

Service[apache-htcacheclean]

Parameters differences:

--- Service[apache-htcacheclean].orig
+++ Service[apache-htcacheclean]

-    ensure => stopped
-    enable => False

Sudo::User[nrpe-check_check_certificate_expiry_aux]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_aux].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_aux]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem']
-    user       => nagios

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - mlserve_front_proxy
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --responses-file /etc/cfssl/ocsp/mlserve_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_front_proxy' mlserve_front_proxy

Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube -profile ocsp /etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet

File[/lib/systemd/system/cfssl-ocspserve@dse.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@dse.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@dse.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@dse.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@dse.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (dse)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20061 \
-          -responses /etc/cfssl/ocsp/dse.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery2026
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem

File[/var/log/cfssl-ocsprefresh-wikikube]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-wikikube].orig
+++ File[/var/log/cfssl-ocsprefresh-wikikube]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet

File[/lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@aux_front_proxy.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (aux_front_proxy)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20051 \
-          -responses /etc/cfssl/ocsp/aux_front_proxy.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]']

Package[python3-cryptography]

Parameters differences:

--- Package[python3-cryptography].orig
+++ Package[python3-cryptography]

-    provider => apt
-    ensure   => installed

File_line[load_env_enabled]

Parameters differences:

--- File_line[load_env_enabled].orig
+++ File_line[load_env_enabled]

-    line    => for f in /etc/apache2/env-enabled/*.sh; do [ -r "$f" ] && . "$f" >&2; done || true
-    match   => env-enabled
-    path    => /etc/apache2/envvars
-    require => Package[apache2]

Exec[Generate initial CRL for wikikube]

Parameters differences:

--- Exec[Generate initial CRL for wikikube].orig
+++ Exec[Generate initial CRL for wikikube]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/wikikube
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/wikikube/ca/wikikube.pem /etc/cfssl/signers/wikikube/ca/wikikube-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/wikikube

File[/etc/cfssl/signers/debmonitor]

Parameters differences:

--- File[/etc/cfssl/signers/debmonitor].orig
+++ File[/etc/cfssl/signers/debmonitor]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Httpd::Conf[pki.discovery.wmnet]

Parameters differences:

--- Httpd::Conf[pki.discovery.wmnet].orig
+++ Httpd::Conf[pki.discovery.wmnet]

-    conf_type => sites
-    ensure    => present
-    priority  => 50

Cfssl::Config[mlserve_staging]

Parameters differences:

--- Cfssl::Config[mlserve_staging].orig
+++ Cfssl::Config[mlserve_staging]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/mlserve_staging
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/mlserve_staging/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    default_expiry      => 72h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/mlserve_staging

Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_dse.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_dse
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem

Exec[renew certificate - OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_aux_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet

Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/lib/systemd/system/cfssl-ocspserve@wikikube.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@wikikube.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@wikikube.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@wikikube.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@wikikube.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (wikikube)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20010 \
-          -responses /etc/cfssl/ocsp/wikikube.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery2026 -profile ocsp /etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[cfssl-ocsprefresh-discovery2026.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-discovery2026.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-discovery2026.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-discovery2026.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Sudo::User[nrpe-check_check_certificate_expiry_debmonitor]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_debmonitor].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_debmonitor]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem']
-    user       => nagios

Prometheus::Alert::Rule[check_check_certificate_expiry_discovery_38e4dbcfd07ed60daf5bb89397abbe29]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_discovery_38e4dbcfd07ed60daf5bb89397abbe29].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_discovery_38e4dbcfd07ed60daf5bb89397abbe29]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_discovery))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: discovery
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: discovery
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="38e4dbcfd07ed60daf5bb89397abbe29",check_name="check_check_certificate_expiry_discovery", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__discovery
-    group              => nrpechecks
-    severity           => info

Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    ensure => present

Sudo::User[nrpe_certificate_check_dse]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_dse].orig
+++ Sudo::User[nrpe_certificate_check_dse]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_dse

File[/etc/cfssl/signers/discovery/ca/discovery-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/discovery/ca/discovery-key.pem].orig
+++ File[/etc/cfssl/signers/discovery/ca/discovery-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/discovery/ca/discovery-key.pem.orig
+++ /etc/cfssl/signers/discovery/ca/discovery-key.pem
@@ -1 +0,0 @@
-##### FAKE FOR PUPPET ######

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]']

Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-mlserve_staging.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse_front_proxy.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse_front_proxy.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse_front_proxy.prom]

-    owner  => root
-    group  => root
-    ensure => absent

File[/etc/cfssl/signers/wikikube_staging]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging].orig
+++ File[/etc/cfssl/signers/wikikube_staging]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Sudo::User[nrpe_certificate_check_mlserve_front_proxy]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_mlserve_front_proxy].orig
+++ Sudo::User[nrpe_certificate_check_mlserve_front_proxy]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_mlserve_front_proxy

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

File[/etc/apache2/env-enabled]

Parameters differences:

--- File[/etc/apache2/env-enabled].orig
+++ File[/etc/apache2/env-enabled]

-    owner   => root
-    recurse => True
-    purge   => True
-    mode    => 0755
-    require => Package[apache2]
-    ensure  => directory
-    group   => root
-    notify  => Service[apache2]

Exec[renew certificate - OCSP_etcd_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_etcd_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_etcd_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label etcd -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet

Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Systemd::Service[cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ Systemd::Service[cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Exec[renew certificate - OCSP_debmonitor_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_debmonitor_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_debmonitor_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label debmonitor -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet

Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_cassandra.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_cassandra]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem

Systemd::Timer[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_kafka
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-dse-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-puppet_rsa.timer]']

Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - wikikube_staging
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --responses-file /etc/cfssl/ocsp/wikikube_staging.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_staging' wikikube_staging

File[/etc/cfssl/signers/zuul]

Parameters differences:

--- File[/etc/cfssl/signers/zuul].orig
+++ File[/etc/cfssl/signers/zuul]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet

Systemd::Timer[cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-debmonitor].orig
+++ Systemd::Timer[cfssl-ocsprefresh-debmonitor]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-debmonitor.service

Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label etcd -profile ocsp /etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-cassandra.timer]']

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging_front_proxy]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_mlserve_staging_front_proxy!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
-    check_interval         => 1

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Profile::Pki::Multirootca::Monitoring[mlserve_front_proxy]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[mlserve_front_proxy].orig
+++ Profile::Pki::Multirootca::Monitoring[mlserve_front_proxy]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
-    intermediate => mlserve_front_proxy

Systemd::Unit[cfssl-ocsprefresh-etcd.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-etcd.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-etcd.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-etcd.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Timer[wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- Systemd::Timer[wmf_auto_restart_apache-htcacheclean].orig
+++ Systemd::Timer[wmf_auto_restart_apache-htcacheclean]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 3:51:00'}]
-    unit_name          => wmf_auto_restart_apache-htcacheclean.service

Profile::Pki::Multirootca::Monitoring[etcd]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[etcd].orig
+++ Profile::Pki::Multirootca::Monitoring[etcd]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/etcd/ca/etcd.pem
-    intermediate => etcd

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging_front_proxy]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_wikikube_staging_front_proxy!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
-    check_interval         => 1

File[/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem].orig
+++ File[/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem.orig
+++ /etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem
@@ -1 +0,0 @@
-##### FAKE FOR PUPPET ######

Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/etc/cfssl/ocsp/dse_front_proxy.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/dse_front_proxy.ocsp].orig
+++ File[/etc/cfssl/ocsp/dse_front_proxy.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-dse_front_proxy-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --outfile /var/lib/prometheus/node.d/dse_front_proxy_intermediate.prom

File[/etc/cfssl/signers/syslog/ca/syslog.pem]

Parameters differences:

--- File[/etc/cfssl/signers/syslog/ca/syslog.pem].orig
+++ File[/etc/cfssl/signers/syslog/ca/syslog.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/syslog/ca/syslog.pem.orig
+++ /etc/cfssl/signers/syslog/ca/syslog.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqTCCAwqgAwIBAgIUI5/ixOCtnw8ZXV6xWw6RVC/D6rwwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwOTI4MTAzNzAwWhcNMjgwOTI2MTAzNzAwWjB0
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ8wDQYDVQQDEwZzeXNsb2cwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABL
-CaZwsDnVcBhApShaeA1j8/9w4S2re0Zmjx7GTeBXiJcKF0dAhgAQRCMrGtWEimmQ
-W94s5015H1MknO61lLOY+wDAFYkq98rZF2aRRILm1w/5iRkqTDiBECBVE15jrPzD
-q4zZCQ5V5ellWhzfGfPMxFOogIm1sqZsqZvB7zZaCSOrbaOCAQwwggEIMA4GA1Ud
-DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRvwMc33QVQ
-qaT1dZmUUtkBeYiyzjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBW
-BggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5
-LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMw
-QTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRp
-YV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAUtK7APyQamN
-8DYOBCd1wJQ1DbYlzcQOcupJns2RKKcxFp1evo2GQjDA15TN1OXtA+pvK/liCAEh
-p828+NcE6fPMAkIBN/Yjhvy0lrtVzshqckUEciShFhbDU0QZOHuzIXCVjdskzQfu
-as4ZMO15kIv0MZUJ6V9aKEE6nqzi9QXifjuoY54=
------END CERTIFICATE-----

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-etcd.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_etcd" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/etc/cfssl/signers/aux]

Parameters differences:

--- File[/etc/cfssl/signers/aux].orig
+++ File[/etc/cfssl/signers/aux]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Cfssl::Ocsp[dse_front_proxy]

Parameters differences:

--- Cfssl::Ocsp[dse_front_proxy].orig
+++ Cfssl::Ocsp[dse_front_proxy]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 20062
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

File[/etc/cfssl/signers/mlserve_front_proxy/ca]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_front_proxy/ca].orig
+++ File[/etc/cfssl/signers/mlserve_front_proxy/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux_front_proxy.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux_front_proxy.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux_front_proxy.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Systemd::Timer[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service

Class[Cfssl::Multirootca]

Parameters differences:

--- Class[Cfssl::Multirootca].orig
+++ Class[Cfssl::Multirootca]

-    host                => 127.0.0.1
-    enable_monitoring   => True
-    monitoring_critical => True
-    ensure              => present
-    port                => 8888
-    signers             => {'debmonitor': {'private': '/etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem', 'certificate': '/etc/cfssl/signers/debmonitor/ca/debmonitor.pem', 'config': '/etc/cfssl/signers/debmonitor/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'discovery': {'private': '/etc/cfssl/signers/discovery/ca/discovery-key.pem', 'certificate': '/etc/cfssl/signers/discovery/ca/discovery.pem', 'config': '/etc/cfssl/signers/discovery/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'kafka': {'private': '/etc/cfssl/signers/kafka/ca/kafka-key.pem', 'certificate': '/etc/cfssl/signers/kafka/ca/kafka.pem', 'config': '/etc/cfssl/signers/kafka/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'cloud_wmnet_ca': {'private': '/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem', 'certificate': '/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem', 'config': '/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'etcd': {'private': '/etc/cfssl/signers/etcd/ca/etcd-key.pem', 'certificate': '/etc/cfssl/signers/etcd/ca/etcd.pem', 'config': '/etc/cfssl/signers/etcd/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'cassandra': {'private': '/etc/cfssl/signers/cassandra/ca/cassandra-key.pem', 'certificate': '/etc/cfssl/signers/cassandra/ca/cassandra.pem', 'config': '/etc/cfssl/signers/cassandra/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'syslog': {'private': '/etc/cfssl/signers/syslog/ca/syslog-key.pem', 'certificate': '/etc/cfssl/signers/syslog/ca/syslog.pem', 'config': '/etc/cfssl/signers/syslog/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'puppet_rsa': {'private': '/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem', 'certificate': '/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem', 'config': '/etc/cfssl/signers/puppet_rsa/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'zuul': {'private': '/etc/cfssl/signers/zuul/ca/zuul-key.pem', 'certificate': '/etc/cfssl/signers/zuul/ca/zuul.pem', 'config': '/etc/cfssl/signers/zuul/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'discovery2026': {'private': '/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem', 'certificate': '/etc/cfssl/signers/discovery2026/ca/discovery2026.pem', 'config': '/etc/cfssl/signers/discovery2026/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'wikikube': {'private': '/etc/cfssl/signers/wikikube/ca/wikikube-key.pem', 'certificate': '/etc/cfssl/signers/wikikube/ca/wikikube.pem', 'config': '/etc/cfssl/signers/wikikube/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'wikikube_front_proxy': {'private': '/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem', 'config': '/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'wikikube_staging': {'private': '/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem', 'certificate': '/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem', 'config': '/etc/cfssl/signers/wikikube_staging/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'wikikube_staging_front_proxy': {'private': '/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem', 'config': '/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'mlserve': {'private': '/etc/cfssl/signers/mlserve/ca/mlserve-key.pem', 'certificate': '/etc/cfssl/signers/mlserve/ca/mlserve.pem', 'config': '/etc/cfssl/signers/mlserve/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'mlserve_front_proxy': {'private': '/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem', 'config': '/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'mlserve_staging': {'private': '/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem', 'certificate': '/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem', 'config': '/etc/cfssl/signers/mlserve_staging/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'mlserve_staging_front_proxy': {'private': '/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem', 'config': '/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'aux': {'private': '/etc/cfssl/signers/aux/ca/aux-key.pem', 'certificate': '/etc/cfssl/signers/aux/ca/aux.pem', 'config': '/etc/cfssl/signers/aux/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'aux_front_proxy': {'private': '/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem', 'config': '/etc/cfssl/signers/aux_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'dse': {'private': '/etc/cfssl/signers/dse/ca/dse-key.pem', 'certificate': '/etc/cfssl/signers/dse/ca/dse.pem', 'config': '/etc/cfssl/signers/dse/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'dse_front_proxy': {'private': '/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem', 'certificate': '/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem', 'config': '/etc/cfssl/signers/dse_front_proxy/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}, 'network_devices': {'private': '/etc/cfssl/signers/network_devices/ca/network_devices-key.pem', 'certificate': '/etc/cfssl/signers/network_devices/ca/network_devices.pem', 'config': '/etc/cfssl/signers/network_devices/cfssl.conf', 'dbconfig': '/etc/cfssl/db.conf', 'nets': ['127.0.0.1/32']}}

Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/sudoers.d/nrpe_certificate_check_mlserve_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_mlserve_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_mlserve_front_proxy]

-    owner  => root
-    group  => root
-    ensure => absent

Cfssl::Config[dse_front_proxy]

Parameters differences:

--- Cfssl::Config[dse_front_proxy].orig
+++ Cfssl::Config[dse_front_proxy]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/dse_front_proxy
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/dse_front_proxy/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/dse_front_proxy

Exec[renew certificate - OCSP_dse_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_dse_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_dse_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet

Sudo::User[nrpe_certificate_check_zuul]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_zuul].orig
+++ Sudo::User[nrpe_certificate_check_zuul]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_zuul

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-mlserve" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-mlserve/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_aux_front_proxy
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem

File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-mlserve.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-mlserve
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-mlserve
-
-/var/log/cfssl-ocsprefresh-mlserve/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Cfssl::Signer[aux_front_proxy]

Parameters differences:

--- Cfssl::Signer[aux_front_proxy].orig
+++ Cfssl::Signer[aux_front_proxy]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDsjCCAxOgAwIBAgIUcL3aZt8/kOKuFw8g90SCOk9VZSYwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjB9
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRgwFgYDVQQDDA9hdXhfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
ACMDgYYABAFQamNeMXOM8jZDTMiL/0Cgk641Tps3tMBQ6f1OD7fqLh7JGWZXSWIE
9v25H6dgcqSIWAlvBkbHQUPU51GmXigXtwCW1bYWFZc+MTjXFo2LBUJVUIxh2mh3
pNZYlgVZXP7a0l3zt2u5vegKRuJ6l0ELtjCJjo/TNYo/BA28XrzCL45HO6OCAQww
ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
BBQv7ovDzaQTat1sfWJFkZ+n8+aGSTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
AZ7oTip5kp2Yt9BABNEqYi6GjwpXZvmZOgd6So8UA76jP8duYicuOoNvpoHdEy58
ZOGpo0lqqIzB8xQcvzvmX7uiAkIAxHVKylOLCoPsUXaZVfUGhNavXXwrbIHTQXDo
HEHmc9lIMh9hO5z4vPMEbMkSRuAskcT1K/ydEqp4xI191jnovUg=
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/aux_front_proxy
-    db_host          => localhost
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => nosecret

-    ca_file          => /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    ca_key_file      => /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/aux_front_proxy
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_etcd.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_etcd.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Systemd::Service[cfssl-ocsprefresh-dse]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-dse].orig
+++ Systemd::Service[cfssl-ocsprefresh-dse]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-dse.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@mlserve_staging_front_proxy.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (mlserve_staging_front_proxy)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20041 \
-          -responses /etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Service[cfssl-ocspserve@discovery2026]

Parameters differences:

--- Service[cfssl-ocspserve@discovery2026].orig
+++ Service[cfssl-ocspserve@discovery2026]

-    ensure => running
-    enable => True

Cfssl::Cert[OCSP_puppet_rsa_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_puppet_rsa_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_puppet_rsa_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => puppet_rsa
-    notify          => Service[cfssl-ocspserve@puppet_rsa]
-    profile         => ocsp

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_staging]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_mlserve_staging!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: mlserve_staging
-    check_interval         => 1

Systemd::Timer[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service

File[/etc/cfssl/signers/wikikube/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube/cfssl.conf].orig
+++ File[/etc/cfssl/signers/wikikube/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/wikikube/cfssl.conf.orig
+++ /etc/cfssl/signers/wikikube/cfssl.conf
@@ -1,81 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/wikikube",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/wikikube"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "service-account-management": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment"
-        ]
-      },
-      "prometheus": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Systemd::Syslog[cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-puppet_rsa].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-puppet_rsa]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Systemd::Syslog[cfssl-ocsprefresh-syslog]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-syslog].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-syslog]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/etc/cfssl/signers/network_devices]

Parameters differences:

--- File[/etc/cfssl/signers/network_devices].orig
+++ File[/etc/cfssl/signers/network_devices]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Cfssl::Signer[etcd]

Parameters differences:

--- Cfssl::Signer[etcd].orig
+++ Cfssl::Signer[etcd]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDpzCCAwigAwIBAgIUOk3cFWirYBfYaO6q8zyqfEHxwVEwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjIwODEwMTAzODAwWhcNMjcwODA5MTAzODAwWjBy
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMQ0wCwYDVQQDEwRldGNkMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAgtdp
7nZHIAQhEm2IlJ7AzfGjWIGGzKzCfnBQ8d+euPiOZ3ccv1YXfx0f+WmV35vuEmA/
ZSw/6iJrKBnYsZAR6U0ByUUqg6nUYg4P47Sc/kMTWmVIgRuNhmrgavCK+qRQdnZs
N/OOGTgFNG0icty63dUF4NZz80HxHSrPQYaNxZ9ydY2jggEMMIIBCDAOBgNVHQ8B
Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUtvZYHyYnZHZP
ZLIB5kqPcVOVI9owHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgEgYyeOREniK9JC
4hvIiuv9D7mVVXzX5/s8GuhTbRadqZr41ulpHT53lFcbt+xhAsyqMxXPhgT/OyMQ
jkXuEh5oBQJCAM22xLZpt2XwKCp0opgXlC5fm5+YjKba2COlr43q78I2la57aYdp
UF7sFgBRFVx7FNY7CASuZMYsW+4wltPTXVau
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/etcd
-    db_host          => localhost
-    default_usages   => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => ##### FAKE FOR PUPPET ######

-    ca_file          => /etc/cfssl/signers/etcd/ca/etcd.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    ca_key_file      => /etc/cfssl/signers/etcd/ca/etcd-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/etcd
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]']

Systemd::Service[cfssl-ocspserve@syslog]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@syslog].orig
+++ Systemd::Service[cfssl-ocspserve@syslog]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Cfssl::Cert[OCSP_dse_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_dse_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_dse_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-dse]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => dse
-    notify          => Service[cfssl-ocspserve@dse]
-    profile         => ocsp

Nrpe::Check[check_check_certificate_expiry_debmonitor]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_debmonitor].orig
+++ Nrpe::Check[check_check_certificate_expiry_debmonitor]

-    before    => Monitoring::Service[check_certificate_expiry_debmonitor]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem

File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Httpd::Site[pki.discovery.wmnet]

Parameters differences:

--- Httpd::Site[pki.discovery.wmnet].orig
+++ Httpd::Site[pki.discovery.wmnet]

-    ensure   => present
-    priority => 50

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_puppet_rsa.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_puppet_rsa.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_puppet_rsa.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Systemd::Unit[cfssl-multirootca]

Parameters differences:

--- Systemd::Unit[cfssl-multirootca].orig
+++ Systemd::Unit[cfssl-multirootca]

-    override          => False
-    unit              => cfssl-multirootca
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Service[cfssl-gc-expired-certs.timer]

Parameters differences:

--- Service[cfssl-gc-expired-certs.timer].orig
+++ Service[cfssl-gc-expired-certs.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem].orig
+++ File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem.orig
+++ /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem
@@ -1 +0,0 @@
-fake

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_discovery" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-mlserve_front_proxy-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_front_proxy_intermediate.prom

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Sudo::User[nrpe_certificate_check_kafka]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_kafka].orig
+++ Sudo::User[nrpe_certificate_check_kafka]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_kafka

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet]

Parameters differences:

--- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet].orig
+++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet]

-    mode    => 0740
-    ensure  => directory
-    owner   => root
-    group   => root
-    recurse => True

File[/etc/cfssl/signers/discovery/ca]

Parameters differences:

--- File[/etc/cfssl/signers/discovery/ca].orig
+++ File[/etc/cfssl/signers/discovery/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Profile::Pki::Multirootca::Monitoring[aux]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[aux].orig
+++ Profile::Pki::Multirootca::Monitoring[aux]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/aux/ca/aux.pem
-    intermediate => aux

Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_front_proxy
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem

Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@wikikube_staging]']
-    command     => /bin/systemctl daemon-reload

Service[cfssl-ocspserve@network_devices]

Parameters differences:

--- Service[cfssl-ocspserve@network_devices].orig
+++ Service[cfssl-ocspserve@network_devices]

-    ensure => running
-    enable => True

Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Cfssl::Config[wikikube_staging_front_proxy]

Parameters differences:

--- Cfssl::Config[wikikube_staging_front_proxy].orig
+++ Cfssl::Config[wikikube_staging_front_proxy]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/wikikube_staging_front_proxy
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_expiry      => 72h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/wikikube_staging_front_proxy

Monitoring::Service[check_certificate_expiry_aux]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_aux].orig
+++ Monitoring::Service[check_certificate_expiry_aux]

-    check_command  => nrpe_check!check_check_certificate_expiry_aux!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: aux
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

Cfssl::Cert[OCSP_mlserve_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_mlserve_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_mlserve_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-mlserve]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => mlserve
-    notify          => Service[cfssl-ocspserve@mlserve]
-    profile         => ocsp

File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/wikikube_staging/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging/cfssl.conf].orig
+++ File[/etc/cfssl/signers/wikikube_staging/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/wikikube_staging/cfssl.conf.orig
+++ /etc/cfssl/signers/wikikube_staging/cfssl.conf
@@ -1,81 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "72h",
-      "crl_url": "http://pki.discovery.wmnet/crl/wikikube_staging",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/wikikube_staging"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "72h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "service-account-management": {
-        "auth_key": "default_auth",
-        "expiry": "72h",
-        "usages": [
-          "digital signature",
-          "key encipherment"
-        ]
-      },
-      "prometheus": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

Sudo::User[nrpe-check_check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_cloud_wmnet_ca].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_cloud_wmnet_ca]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem']
-    user       => nagios

Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Sudo::User[nrpe_certificate_check_discovery]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_discovery].orig
+++ Sudo::User[nrpe_certificate_check_discovery]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_discovery

File[/etc/apache2/ports.conf]

Parameters differences:

--- File[/etc/apache2/ports.conf].orig
+++ File[/etc/apache2/ports.conf]

-    require => Package[apache2]
-    source  => puppet:///modules/httpd/default-ports.conf
-    ensure  => file
-    owner   => root
-    group   => root
-    notify  => Service[apache2]

Rsyslog::Conf[wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- Rsyslog::Conf[wmf_auto_restart_apache-htcacheclean].orig
+++ Rsyslog::Conf[wmf_auto_restart_apache-htcacheclean]

-    mode     => 0444
-    require  => File[/var/log/wmf_auto_restart_apache-htcacheclean]
-    ensure   => absent
-    priority => 40

Nrpe::Check[check_check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_aux_front_proxy].orig
+++ Nrpe::Check[check_check_certificate_expiry_aux_front_proxy]

-    before    => Monitoring::Service[check_certificate_expiry_aux_front_proxy]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem

Prometheus::Blackbox::Check::Http[PKI_kafka]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_kafka].orig
+++ Prometheus::Blackbox::Check::Http[PKI_kafka]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"kafka"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer].orig
+++ Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Systemd::Timer[cfssl-ocsprefresh-syslog]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-syslog].orig
+++ Systemd::Timer[cfssl-ocsprefresh-syslog]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-syslog.service

Monitoring::Service[check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_aux_front_proxy].orig
+++ Monitoring::Service[check_certificate_expiry_aux_front_proxy]

-    check_command  => nrpe_check!check_check_certificate_expiry_aux_front_proxy!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: aux_front_proxy
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/etc/cfssl/signers/debmonitor/ca/debmonitor.pem]

Parameters differences:

--- File[/etc/cfssl/signers/debmonitor/ca/debmonitor.pem].orig
+++ File[/etc/cfssl/signers/debmonitor/ca/debmonitor.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/debmonitor/ca/debmonitor.pem.orig
+++ /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqzCCAw6gAwIBAgIUD8gl+8iTKG2ZJ9eRsZs5/C9/7ZMwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMzE0MTM0NTAwWhcNMjgwMzEyMTM0NTAwWjB4
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRMwEQYDVQQDEwpkZWJtb25pdG9yMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
-AAQBNH4qwApzKzoZpcUF5+rzNhzi2ETF1ToNoWJ4XIJH/PmYzcXmDj41+b+4p4++
-M+ENQtHt6dfCVv0BmGr8XYTU3YUAQUiLhv/X41GLwCV4Nx5jsnpnlfyi2tfXY2b1
-WgpdkxBTQi79fWYWJFvuy7AFhP0ahKcKfauegEHf1zJ/j7pKyjSjggEMMIIBCDAO
-BgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU35FY
-TrdI8tZ8bKAVj8qkrn5sp9QwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9p
-EzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2Nv
-dmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1Ud
-HwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtp
-bWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYCQXXZh0fs
-XIlOkz1OPSSRBbEZ6zjvGEJvR6qPVpdkQ8IY+bwqe6J/wrhlAgWfTq7ODhEQYCnx
-y9Jdg7TfybUaOnmiAkEGKMoHIi/MXfzVrKicaCo4aHIL14vN3V4go08bIsMuIs7p
-EknA+x7QLKFunnrATNeeF6ETr+3u9/MUDWGW+fBqEw==
------END CERTIFICATE-----

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_puppet_rsa command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_puppet_rsa
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "c1b324b3d8ac107f8d7483b4017f5edf" --timeout 10 --check-command "check_check_certificate_expiry_puppet_rsa"

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Profile::Auto_restarts::Service[apache2]

Parameters differences:

--- Profile::Auto_restarts::Service[apache2].orig
+++ Profile::Auto_restarts::Service[apache2]

-    ensure => present

File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - aux_front_proxy
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --responses-file /etc/cfssl/ocsp/aux_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@aux_front_proxy' aux_front_proxy

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_wikikube" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/srv/cfssl/bundles/zuul.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/zuul.pem].orig
+++ File[/srv/cfssl/bundles/zuul.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/zuul.pem.orig
+++ /srv/cfssl/bundles/zuul.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpzCCAwigAwIBAgIUMIxkteGnxVGRNFWjJZ+eXPnOeM8wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjUwODIwMTg1NTAwWhcNMzAwODE5MTg1NTAwWjBy
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ0wCwYDVQQDEwR6dXVsMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBNx/m
-dSpc4EWI68Y36PVvDkvyqlJ6pA4sEXQCrNOM+0jSACRM8Shwqr7uC/JmuP8GIdK3
-g+SgxQOjF9pfelX2OpAB6leOfgHXhFtzJquX261tKsxQm74cszycF9YTiWDKVq0V
-g7bFNgf4NcC7NxGfN4SuA58I7dQWJxSWdzTJNQsF2uijggEMMIIBCDAOBgNVHQ8B
-Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUqyQEoVfbsJqL
-jr5RyZovCpWdRZUwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
-KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
-bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
-P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
-SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgER9R3mwAtzYcIh
-HAnL2SiHTXBpqitQp6Ce+7nYFP0qyu+Ggkx2bu86bl32lGmvA6ecTKXDiyXW5pMW
-atmKn0wAegJCAaU9pfWuLIgsVqzB2zvDWMR2HgBMa6MO7dRlG2VUoLvR16NF9cln
-XjNzIqPRxUpiD5TNC4+p9BoT+RRXEDUeRufH
------END CERTIFICATE-----

Monitoring::Exported_nagios_service[pki1001 ssh]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 ssh].orig
+++ Monitoring::Exported_nagios_service[pki1001 ssh]

@@
-    notifications_enabled => 1
+    notifications_enabled => 0
@@
-    servicegroups         => pki_eqiad
+    servicegroups         => insetup_eqiad

Service[nrpe2nodexp-check_certificate_expiry_mlserve.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_mlserve.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_mlserve.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]']

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-puppet-rsa.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-puppet_rsa" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-puppet_rsa/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]']

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-wikikube_staging]
-    ensure   => present
-    priority => 40

Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Exec[renew certificate - OCSP_mlserve_staging_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_mlserve_staging_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_mlserve_staging_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet

Systemd::Syslog[cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-wikikube_front_proxy]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-network_devices.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-network_devices.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-network_devices.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-network_devices.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File_line[auto_restart_file_presence_apache2]

Parameters differences:

--- File_line[auto_restart_file_presence_apache2].orig
+++ File_line[auto_restart_file_presence_apache2]

-    line    => apache2
-    require => File[/etc/debdeploy-client/autorestarts.conf]
-    path    => /etc/debdeploy-client/autorestarts.conf
-    ensure  => present

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-Wikimedia-Internal-Root-CA.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-Wikimedia_Internal_Root_CA" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Systemd::Timer[cfssl-ocsprefresh-etcd]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-etcd].orig
+++ Systemd::Timer[cfssl-ocsprefresh-etcd]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-etcd.service

Systemd::Service[cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-puppet_rsa].orig
+++ Systemd::Service[cfssl-ocsprefresh-puppet_rsa]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Nrpe::Monitor_service[check_certificate_expiry_dse]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_dse].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_dse]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: dse
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_cloud_wmnet_ca.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_cloud_wmnet_ca]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem

File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-wikikube_staging
-
-/var/log/cfssl-ocsprefresh-wikikube_staging/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Profile::Pki::Multirootca::Monitoring[dse]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[dse].orig
+++ Profile::Pki::Multirootca::Monitoring[dse]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/dse/ca/dse.pem
-    intermediate => dse

File[/etc/cfssl/ocsp/dse.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/dse.ocsp].orig
+++ File[/etc/cfssl/ocsp/dse.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Prometheus::Blackbox::Check::Http[PKI_discovery2026]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_discovery2026].orig
+++ Prometheus::Blackbox::Check::Http[PKI_discovery2026]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"discovery2026"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cloud-wmnet-ca.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Unit[cfssl-ocspserve@network_devices]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@network_devices].orig
+++ Systemd::Unit[cfssl-ocspserve@network_devices]

-    override          => False
-    unit              => cfssl-ocspserve@network_devices
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-mlserve_front_proxy.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_debmonitor]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_debmonitor].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_debmonitor]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_debmonitor.service

Systemd::Syslog[cfssl-ocsprefresh-kafka]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-kafka].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-kafka]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/usr/local/bin/prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-network_devices-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-network_devices-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Cfssl::Signer[puppet_rsa]

Parameters differences:

--- Cfssl::Signer[puppet_rsa].orig
+++ Cfssl::Signer[puppet_rsa]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIFNDCCBJagAwIBAgIUOR+ZAFtrzLKYphDIGMa9eF6O0LIwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjIwMTIwNTAwWhcNMjgwNjE4MTIwNTAwWjB4
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRMwEQYDVQQDDApwdXBwZXRfcnNhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
MIICCgKCAgEA4urK5Og7RVGoXg6KzYywzaXyRROuj0Kauc7n/BgCWvsKv9Ll4f/p
lbVGOSln3akzhBlJwmVTGrgCmWQVxMF2agKAR+R1aV2Wc+yEfofUbW1oRgBCelMQ
Xutw0cApO+lzjHNtduffeIEVBjwLcEG/OdaUa2CGFGLG/dHox7o8AZgkH7SFJyby
z/rzip+szHpMThhjs0PKx91VS1srb7Q1jE1OlB7ydhX+gLRWTjwxOp1ITFXjNobk
i16jcP3YYgCvj8qwWMcYmtI7iExSeFdptv3fmajBeoi1o52LUWKUrslwtNa/emaB
FBGRZfu8ap+BWWpYYarI4mOCyvetw/6FZ2LnuWy5cNA3GoALB5xfLpO3twYnrveP
BnxULp4Q8szITB/bjPBMkd8FG8Frpe3eZNKNHG9xjJGdS1Bxhq7Zgfy09V1RJCym
AJSWERHRrxjEnRCDd7HUAhfaDCygeooe4wGRR5bG8WqOpkQDtYPP3yfk5NBhcJpW
mXTRFTFkuslEL/2bwa9EPIOAKAINDeJOCHqJMQd6EXwTP2LabWU3oI+sfeBdCoSd
Rn+q2Z0kSLu8fqXsgPgvdgyWjfPkQnyLAz9rdsal2x4x9SilDkov+l6Q9DXGGoYO
GGOHHFCFhM9CS02zFGLe1JbqiHPuYuIkEnGjGJyCqdIB8Rz0JxdypEcCAwEAAaOC
AQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1Ud
DgQWBBRrq/ZHBKl8OZGQrQCiUq4GRc86YDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yA
vzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9w
a2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3Rf
Q0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQv
Y3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCB
hwJBJHrjuBvyK8Sv40xCW/TrVtOCIVaXfjwsKau9lkmt/6purO/xkppZDMajueYw
9koKhj6SvliOpiwgypfOKP7nbsACQgFAnawARDYCoOQ8pQDoqpRkPBBScMOTMPFu
xTekxW2V7POn9dn6uavLJz/wha+sNgAnYT4wHWkRJzbUk+1H3Hb3NA==
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/puppet_rsa
-    db_host          => localhost
-    default_usages   => ['digital signature', 'key encipherment', 'server auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => nosecret

-    ca_file          => /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'mtls': {'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    ca_key_file      => /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/puppet_rsa
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

File[/etc/sudoers.d/nrpe_certificate_check_etcd]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_etcd].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_etcd]

-    owner  => root
-    group  => root
-    ensure => absent

Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux -profile ocsp /etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet

Cfssl::Signer[discovery2026]

Parameters differences:

--- Cfssl::Signer[discovery2026].orig
+++ Cfssl::Signer[discovery2026]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDrzCCAxGgAwIBAgIUa46nWae1FhV+WZzdsRMJchzTP54wCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjYwNDIwMTUzNjAwWhcNMzEwNDE5MTUzNjAwWjB7
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRYwFAYDVQQDEw1kaXNjb3ZlcnkyMDI2MIGbMBAGByqGSM49AgEGBSuBBAAj
A4GGAAQBNeE+xxvbq00KO92aWhHFTLosZBkXul9ufZINtOUd90TXpQnJvpEv7kK8
HQpufac9Dez+MBhLzQXoTY+ElhRCsQQBwlu+rIeqpbJEh87DQ2RTfzhTJmlm/9de
1fiM38/51DacwYS/vW0psN/lKSoM7cX/Paw6Qg7pBUmUGCq2vE9wDbmjggEMMIIB
CDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU
SXZcMeXrgnEYbZ3z1m8j/+8XmugwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR
0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRp
c2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoG
A1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9X
aWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQgD4
UGn506FGvacDvYS6t8JEMo6YH7jxK8dKeiZNEnhG5FSjA4Lt2BCz85sOBczxSD9h
b9wLCxy5wOpifRePlyrZQgJBNKUXBImWpyoHmt6hNOA6X7+FmGl0tD5tLnbeuPx7
aTlv8rfJ0d7JdsZXx+7M6YcsmxMgZCKUh4UMYu/WcczIq30=
-----END CERTIFICATE-----
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/discovery2026
-    db_host          => localhost
-    default_usages   => ['digital signature', 'key encipherment', 'server auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => ##### FAKE FOR PUPPET ######

-    ca_file          => /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}
-    ca_key_file      => /etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/discovery2026
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_staging]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_wikikube_staging!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: wikikube_staging
-    check_interval         => 1

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/cfssl/signers/kafka/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/kafka/cfssl.conf].orig
+++ File[/etc/cfssl/signers/kafka/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/kafka/cfssl.conf.orig
+++ /etc/cfssl/signers/kafka/cfssl.conf
@@ -1,75 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/kafka",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/kafka"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "kafka_11": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-puppet-rsa.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_puppet_rsa" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Service[cfssl-ocspserve@aux]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@aux].orig
+++ Systemd::Service[cfssl-ocspserve@aux]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging_front_proxy.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging_front_proxy.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging_front_proxy.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Systemd::Unit[cfssl-ocspserve@debmonitor]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@debmonitor].orig
+++ Systemd::Unit[cfssl-ocspserve@debmonitor]

-    override          => False
-    unit              => cfssl-ocspserve@debmonitor
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Systemd::Unit[cfssl-ocspserve@discovery2026]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@discovery2026].orig
+++ Systemd::Unit[cfssl-ocspserve@discovery2026]

-    override          => False
-    unit              => cfssl-ocspserve@discovery2026
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Systemd::Syslog[cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-discovery2026].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-discovery2026]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Systemd::Timer[cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-dse_front_proxy].orig
+++ Systemd::Timer[cfssl-ocsprefresh-dse_front_proxy]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-dse_front_proxy.service

File[/etc/sudoers.d/nrpe-check_check_cfssl-multirootca_status]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_cfssl-multirootca_status].orig
+++ File[/etc/sudoers.d/nrpe-check_check_cfssl-multirootca_status]

-    owner   => root
-    require => Package[nagios-nrpe-server]
-    group   => root
-    ensure  => absent

Httpd::Conf[server-status]

Parameters differences:

--- Httpd::Conf[server-status].orig
+++ Httpd::Conf[server-status]

-    require   => Httpd::Mod_conf[status]
-    source    => puppet:///modules/httpd/status.conf
-    priority  => 50
-    ensure    => present
-    conf_type => conf

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_network_devices.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/ocsp/mlserve_front_proxy.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/mlserve_front_proxy.ocsp].orig
+++ File[/etc/cfssl/ocsp/mlserve_front_proxy.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

File[/lib/systemd/system/cfssl-ocsprefresh-syslog.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-syslog.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-syslog.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-syslog.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-syslog.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-syslog.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-syslog.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-aux_front_proxy.timer]']

Systemd::Service[cfssl-ocspserve@dse]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@dse].orig
+++ Systemd::Service[cfssl-ocspserve@dse]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_staging command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_wikikube_staging
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "f389c556cebfcfc345b3d6802f320045" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_staging"

Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-discovery-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-discovery-certificate-expiry --cert-path /etc/cfssl/signers/discovery/ca/discovery.pem --outfile /var/lib/prometheus/node.d/discovery_intermediate.prom

Profile::Pki::Multirootca::Monitoring[aux_front_proxy]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[aux_front_proxy].orig
+++ Profile::Pki::Multirootca::Monitoring[aux_front_proxy]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
-    intermediate => aux_front_proxy

Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-mlserve_staging_front_proxy.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Sudo::User[nrpe_certificate_check_cassandra]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_cassandra].orig
+++ Sudo::User[nrpe_certificate_check_cassandra]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_cassandra

Prometheus::Node_textfile[prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry --cert-path /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --outfile /var/lib/prometheus/node.d/cloud_wmnet_ca_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Syslog[cfssl-ocsprefresh-dse]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-dse].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-dse]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_aux command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_aux
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "f7dfe9e2cd77303dfae7ae11c5c56d90" --timeout 10 --check-command "check_check_certificate_expiry_aux"

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_front_proxy_b194b5b9b6c9d6e05b9eed8dcfcc40cf]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_front_proxy_b194b5b9b6c9d6e05b9eed8dcfcc40cf].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_front_proxy_b194b5b9b6c9d6e05b9eed8dcfcc40cf]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_mlserve_staging_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="b194b5b9b6c9d6e05b9eed8dcfcc40cf",check_name="check_check_certificate_expiry_mlserve_staging_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__mlserve_staging_front_proxy
-    group              => nrpechecks
-    severity           => info

File[/etc/cfssl/signers/mlserve/ca]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve/ca].orig
+++ File[/etc/cfssl/signers/mlserve/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]']

File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging]

-    owner  => root
-    group  => root
-    ensure => absent

Exec[Generate initial CRL for dse]

Parameters differences:

--- Exec[Generate initial CRL for dse].orig
+++ Exec[Generate initial CRL for dse]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/dse
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/dse/ca/dse.pem /etc/cfssl/signers/dse/ca/dse-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/dse

Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)].orig
+++ Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_cfssl-multirootca_status.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_cfssl-multirootca_status]=/usr/local/lib/nagios/plugins/check_systemd_unit_status cfssl-multirootca

File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.service (cfssl-ocsprefresh-dse_front_proxy.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - dse_front_proxy
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --responses-file /etc/cfssl/ocsp/dse_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@dse_front_proxy' dse_front_proxy

File[/etc/cfssl/ocsp/aux.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/aux.ocsp].orig
+++ File[/etc/cfssl/ocsp/aux.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Sudo::User[nrpe-check_check_certificate_expiry_zuul]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_zuul].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_zuul]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem']
-    user       => nagios

File[/etc/cfssl/signers/wikikube/ca/wikikube.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube/ca/wikikube.pem].orig
+++ File[/etc/cfssl/signers/wikikube/ca/wikikube.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/wikikube/ca/wikikube.pem.orig
+++ /etc/cfssl/signers/wikikube/ca/wikikube.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqzCCAwygAwIBAgIUWXrkQs5GEdgVcV7/XAEZOXQLYlowCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB2
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMREwDwYDVQQDEwh3aWtpa3ViZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAE
-AX4fMTh3NrBZlCMop5eKr6F/RXTefrSSdu6DE39OOKTTdYM3TxK8tPmTDm9EE+XT
-4rO+VHuaIVVirgB2JQtla8oZAZb60Pw8v9BlJ1JLLK9vpWA9Vce7DKmMNxIWK9GA
-YIUQufjHVD2eibYJsK54NGkBe3frhPhwayIvzJ3gGO34GRaRo4IBDDCCAQgwDgYD
-VR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFAaU1Sae
-B9+FDd+SrIADU8yIo+xJMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2
-MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zl
-cnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8E
-QzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1l
-ZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBFZVjRbh3
-GaouRaz9IPef3q+9s+TleKGby7nJQ6z71M3rpJIsHr9lncr/9GPq5v5cHDYOHmgK
-GBupTY7FNMwL8aACQgCgoDP6PO23Dw6tuswLIbeY+o5l3K8R5L3RS1DO59OXXV2f
-9FmoJNLgGXgP87rOkFW1fn9/QcvX85zD0urkq8gNjg==
------END CERTIFICATE-----

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Service[cfssl-ocsprefresh-cassandra]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-cassandra].orig
+++ Systemd::Service[cfssl-ocsprefresh-cassandra]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-cassandra.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Nrpe::Monitor_service[check_certificate_expiry_cassandra]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_cassandra].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_cassandra]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: cassandra
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-wikikube.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-wikikube.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Service[cfssl-ocspserve@cassandra]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@cassandra].orig
+++ Systemd::Service[cfssl-ocspserve@cassandra]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Cfssl::Signer[wikikube_staging_front_proxy]

Parameters differences:

--- Cfssl::Signer[wikikube_staging_front_proxy].orig
+++ Cfssl::Signer[wikikube_staging_front_proxy]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDwDCCAyGgAwIBAgIUJT4TJHFy4qcc2DDVjG00p9VDOcIwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
ijELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
aW9uczElMCMGA1UEAwwcd2lraWt1YmVfc3RhZ2luZ19mcm9udF9wcm94eTCBmzAQ
BgcqhkjOPQIBBgUrgQQAIwOBhgAEAQkWDUaTmBFtrLcFLkOP5LV+kGQdr0TIYAMX
FR7UbUmysish4+UlH7C2vcugX/XmmIoh2asGRkfb0kjTQUUjqDmmANYQARMmx/V4
j87yMi11K3IxBh2Ei7KJzvXD5yhg/rQa1TVcdvZ1GHBL1QvBU5x2L95G+Exi1amQ
dC4vktygtdo8o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB
Af8CAQEwHQYDVR0OBBYEFANI4okfmz36Vpe1jEq4tkgKl5HzMB8GA1UdIwQYMBaA
FDutonHmNL0b/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcw
AYY6aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50
ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2Nv
dmVyeS53bW5ldC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZI
zj0EAwQDgYwAMIGIAkIBuKBFQ/g6puAs+HK7+bE4eiatpN7eotPUTNbVuxN4+rEO
E6JEpXslb/Ad0rVDvEOmXGSH9EdqjCNJs0Qv5kFnqZQCQgCPyFWGoBUxDcWLjOEL
2a1pt4joI2BUut3NtLOBgPeaI/5qqPoLFbxn/1DMBmZLlsoNhnrg99F5LgvQVEAA
/3y5tw==
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/wikikube_staging_front_proxy
-    db_host          => localhost
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => test

-    ca_file          => /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    ca_key_file      => /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 72h
-    default_crl_url  => http://pki.discovery.wmnet/crl/wikikube_staging_front_proxy
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_syslog]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_syslog].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_syslog]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

File[/etc/cfssl/ocsp/mlserve.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/mlserve.ocsp].orig
+++ File[/etc/cfssl/ocsp/mlserve.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Prometheus::Blackbox::Check::Http[PKI_wikikube_staging_front_proxy]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_wikikube_staging_front_proxy].orig
+++ Prometheus::Blackbox::Check::Http[PKI_wikikube_staging_front_proxy]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"wikikube_staging_front_proxy"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Systemd::Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-puppet-rsa-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]
-    ensure   => present
-    priority => 40

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]']

Profile::Pki::Multirootca::Monitoring[debmonitor]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[debmonitor].orig
+++ Profile::Pki::Multirootca::Monitoring[debmonitor]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
-    intermediate => debmonitor

Nrpe::Check[check_check_certificate_expiry_cassandra]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_cassandra].orig
+++ Nrpe::Check[check_check_certificate_expiry_cassandra]

-    before    => Monitoring::Service[check_certificate_expiry_cassandra]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem

Profile::Pki::Multirootca::Monitoring[puppet_rsa]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[puppet_rsa].orig
+++ Profile::Pki::Multirootca::Monitoring[puppet_rsa]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
-    intermediate => puppet_rsa

Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]']

Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet

Prometheus::Alert::Rule[check_check_certificate_expiry_dse_front_proxy_2560f4f577ba169af651cf96bd5dc1ba]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_dse_front_proxy_2560f4f577ba169af651cf96bd5dc1ba].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_dse_front_proxy_2560f4f577ba169af651cf96bd5dc1ba]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_dse_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: dse_front_proxy
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: dse_front_proxy
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="2560f4f577ba169af651cf96bd5dc1ba",check_name="check_check_certificate_expiry_dse_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__dse_front_proxy
-    group              => nrpechecks
-    severity           => info

Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - wikikube_staging_front_proxy
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --responses-file /etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_staging_front_proxy' wikikube_staging_front_proxy

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]']

Cfssl::Signer[cassandra]

Parameters differences:

--- Cfssl::Signer[cassandra].orig
+++ Cfssl::Signer[cassandra]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDqjCCAw2gAwIBAgIUN8PPoG0JeyUfDWKQhN0B2AOw4G8wCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjE5MTI1MDAwWhcNMjgwNjE3MTI1MDAwWjB3
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRIwEAYDVQQDEwljYXNzYW5kcmEwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
BABpd+xtElegZM2bsg1caGxmHV5hs7l7qxmKFS3oSAu1jo1+N/uSppDtSWZzG+8C
zjIrytBMxBWhNqsOw9msEWhbBAEYESw1oKj+APqOlCafGdXQI1ZvMafexxTqDNN1
CA2gq4ivn82r2Ya3LLqwICxK3MlcmGuLwR5amxiLchok3cZ3X6OCAQwwggEIMA4G
A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQBN6m6
eyaSV8l2Il/bwcfpWTmplDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GKADCBhgJBRhCSOg5L
+EuYGdsW8T9S/tXzYURZpnQItn2nYjM6ky1nxqG6F+V2WsiijiPpEQxr7QUvfZhf
D2zhB5BS8ynWCpYCQRGo4eZuUHyRMNqg/ZDljT1dqr09n0wQhszrJ4eCmebLVsDm
B6AM3pPRygYo0REwxHbpTBAIt26zjGiKiFQqUjwa
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/cassandra
-    db_host          => localhost
-    default_usages   => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => nosecret

-    ca_file          => /etc/cfssl/signers/cassandra/ca/cassandra.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    ca_key_file      => /etc/cfssl/signers/cassandra/ca/cassandra-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/cassandra
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_dse.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging]

-    ensure => present

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_dse_front_proxy
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem

File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]']

File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Systemd::Syslog[cfssl-ocsprefresh-discovery]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-discovery].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-discovery]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/etc/cfssl/signers/mlserve_staging]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging].orig
+++ File[/etc/cfssl/signers/mlserve_staging]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Exec[renew certificate - OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]']

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_zuul.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-cloud_wmnet_ca.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-cloud_wmnet_ca.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer::Job[cfssl-ocsprefresh-etcd]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-etcd].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-etcd]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - etcd
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/etcd/ca/etcd.pem --responses-file /etc/cfssl/ocsp/etcd.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@etcd' etcd

File[/etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf]

Parameters differences:

--- File[/etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf].orig
+++ File[/etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[apache2]

Content differences:

--- /etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf.orig
+++ /etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf
@@ -1 +0,0 @@
-Listen 8443

Exec[renew certificate - OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cloud_wmnet_ca -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

File[/etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-dse_front_proxy
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-dse_front_proxy
-
-/var/log/cfssl-ocsprefresh-dse_front_proxy/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-mlserve_staging
-
-/var/log/cfssl-ocsprefresh-mlserve_staging/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_discovery.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - wikikube_front_proxy
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --responses-file /etc/cfssl/ocsp/wikikube_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_front_proxy' wikikube_front_proxy

Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_f389c556cebfcfc345b3d6802f320045]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_f389c556cebfcfc345b3d6802f320045].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_f389c556cebfcfc345b3d6802f320045]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_wikikube_staging))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_staging
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_staging
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="f389c556cebfcfc345b3d6802f320045",check_name="check_check_certificate_expiry_wikikube_staging", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__wikikube_staging
-    group              => nrpechecks
-    severity           => info

Systemd::Unit[cfssl-ocspserve@dse]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@dse].orig
+++ Systemd::Unit[cfssl-ocspserve@dse]

-    override          => False
-    unit              => cfssl-ocspserve@dse
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-cassandra-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-cassandra-certificate-expiry --cert-path /etc/cfssl/signers/cassandra/ca/cassandra.pem --outfile /var/lib/prometheus/node.d/cassandra_intermediate.prom

Systemd::Timer[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service

Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Service[cfssl-ocsprefresh-kafka.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-kafka.timer].orig
+++ Service[cfssl-ocsprefresh-kafka.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Rsyslog::Conf[cfssl-gc-expired-certs]

Parameters differences:

--- Rsyslog::Conf[cfssl-gc-expired-certs].orig
+++ Rsyslog::Conf[cfssl-gc-expired-certs]

-    mode     => 0444
-    require  => File[/var/log/cfssl-gc-expired-certs]
-    ensure   => present
-    priority => 40

File[/etc/cfssl/ocsp/syslog.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/syslog.ocsp].orig
+++ File[/etc/cfssl/ocsp/syslog.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Systemd::Timer[cfssl-ocsprefresh-kafka]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-kafka].orig
+++ Systemd::Timer[cfssl-ocsprefresh-kafka]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-kafka.service

Service[cfssl-ocsprefresh-debmonitor.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-debmonitor.timer].orig
+++ Service[cfssl-ocsprefresh-debmonitor.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/etc/cfssl/signers/puppet_rsa/ca]

Parameters differences:

--- File[/etc/cfssl/signers/puppet_rsa/ca].orig
+++ File[/etc/cfssl/signers/puppet_rsa/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Systemd::Syslog[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Prometheus::Node_textfile[prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-mlserve_front_proxy-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_front_proxy_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Exec[ensure_present_mod_filter]

Parameters differences:

--- Exec[ensure_present_mod_filter].orig
+++ Exec[ensure_present_mod_filter]

-    require => Package[apache2]
-    creates => /etc/apache2/mods-enabled/filter.load
-    notify  => Service[apache2]
-    command => /usr/sbin/a2enmod filter

Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-dse_front_proxy.timer]']

Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@network_devices]']
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[nrpe2nodexp-check_cfssl-multirootca_status.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_cfssl-multirootca_status.timer].orig
+++ Service[nrpe2nodexp-check_cfssl-multirootca_status.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]']

Nrpe::Monitor_service[check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_aux_front_proxy].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_aux_front_proxy]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: aux_front_proxy
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-etcd-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Unit[cfssl-ocspserve@dse_front_proxy]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@dse_front_proxy].orig
+++ Systemd::Unit[cfssl-ocspserve@dse_front_proxy]

-    override          => False
-    unit              => cfssl-ocspserve@dse_front_proxy
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Exec[renew certificate - OCSP_wikikube_staging_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_wikikube_staging_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_wikikube_staging_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet

Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Exec[Generate initial CRL for cloud_wmnet_ca]

Parameters differences:

--- Exec[Generate initial CRL for cloud_wmnet_ca].orig
+++ Exec[Generate initial CRL for cloud_wmnet_ca]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/cloud_wmnet_ca
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/cloud_wmnet_ca

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_syslog.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_syslog.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Exec[Generate initial CRL for discovery]

Parameters differences:

--- Exec[Generate initial CRL for discovery].orig
+++ Exec[Generate initial CRL for discovery]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/discovery
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/discovery/ca/discovery.pem /etc/cfssl/signers/discovery/ca/discovery-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/discovery

Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ File[/var/log/cfssl-ocsprefresh-cloud_wmnet_ca]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Profile::Pki::Multirootca::Monitoring[dse_front_proxy]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[dse_front_proxy].orig
+++ Profile::Pki::Multirootca::Monitoring[dse_front_proxy]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
-    intermediate => dse_front_proxy

File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-cloud_wmnet_ca.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - cloud_wmnet_ca
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --responses-file /etc/cfssl/ocsp/cloud_wmnet_ca.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@cloud_wmnet_ca' cloud_wmnet_ca

Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh]

Parameters differences:

--- Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh].orig
+++ Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh]

-    subscribe   => File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
-    refreshonly => True
-    environment => ['GODEBUG=x509ignoreCN=0']
-    notify      => ['Service[apache2]']
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa  /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet

File[/etc/cfssl/signers/syslog/ca/syslog-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/syslog/ca/syslog-key.pem].orig
+++ File[/etc/cfssl/signers/syslog/ca/syslog-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/syslog/ca/syslog-key.pem.orig
+++ /etc/cfssl/signers/syslog/ca/syslog-key.pem
@@ -1 +0,0 @@
-nosecret

Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_front_proxy.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_front_proxy.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_front_proxy.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_etcd]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_etcd].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_etcd]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_etcd.service

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]']

Prometheus::Blackbox::Check::Http[PKI_syslog]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_syslog].orig
+++ Prometheus::Blackbox::Check::Http[PKI_syslog]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"syslog"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]

Parameters differences:

--- Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)].orig
+++ Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.timer (cfssl-ocsprefresh-network_devices.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-network_devices.timer]']

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-network-devices.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_network_devices" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_dse" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_network_devices.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_network_devices.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Service[cfssl-ocspserve@kafka]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@kafka].orig
+++ Systemd::Service[cfssl-ocspserve@kafka]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Systemd::Unit[cfssl-ocsprefresh-etcd.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-etcd.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-etcd.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-etcd.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/ocsp/zuul.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/zuul.ocsp].orig
+++ File[/etc/cfssl/ocsp/zuul.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label syslog -profile ocsp /etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_puppet_rsa].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_puppet_rsa command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_puppet_rsa
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "c1b324b3d8ac107f8d7483b4017f5edf" --timeout 10 --check-command "check_check_certificate_expiry_puppet_rsa"

File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem].orig
+++ File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem.orig
+++ /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDuDCCAxmgAwIBAgIUCqmj+2MwaOqLPb5TPXkbkF/PGkUwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
-gjELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczEdMBsGA1UEAwwUd2lraWt1YmVfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0C
-AQYFK4EEACMDgYYABAAUuXSlLM/Sq6jmsr6/+aqYnBNDoelW5+uJ8kWFyR/9xaFf
-hmvvui358ZLmOym6cA1tpoA1+PVZ1sVOE++GDsWQ3QDAG2kk8o0QxpXsCXLWBmJZ
-92Z/pIO7Fc65qe6XDnuZLEaqbb6VWkqQPI15cL9AhJ8HgNbaoaxrT51MfCrHEteP
-raOCAQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0G
-A1UdDgQWBBTlGjpQ7L1N14lCjcKcI/4LLNraBjAfBgNVHSMEGDAWgBQ7raJx5jS9
-G/yAvzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6
-Ly9wa2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jv
-b3RfQ0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21u
-ZXQvY3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GM
-ADCBiAJCAYT0XLJdjumemn8jpqv058zb+c+3zb+05EhNcj15wcjRUq8SU+c2+H8a
-hzfph97+CVSvGaV6Cf7phTSEBDPk9+T4AkIBdOmzIcRH+K9UcDzvdxqerOiXJaBC
-0Bgbg9dOhcd6d0j3CObOuIp760FFQLSli2ocG3WLkfNsXlL1/3+VL+yarNo=
------END CERTIFICATE-----

File[/lib/systemd/system/cfssl-multirootca.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-multirootca.service].orig
+++ File[/lib/systemd/system/cfssl-multirootca.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)]

Content differences:

--- /lib/systemd/system/cfssl-multirootca.service.orig
+++ /lib/systemd/system/cfssl-multirootca.service
@@ -1,14 +0,0 @@
-[Unit]
-Description=Cloudflare SSL MultiRootCA
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/blob/master/doc/cmd/multiroot.txt
-
-[Service]
-ExecStart=/usr/bin/multirootca \
-          -a "127.0.0.1:8888" \
-          -roots /etc/cfssl/multiroot.conf 
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Sudo::User[nrpe_certificate_check_mlserve_staging_front_proxy]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_mlserve_staging_front_proxy].orig
+++ Sudo::User[nrpe_certificate_check_mlserve_staging_front_proxy]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_mlserve_staging_front_proxy

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@dse.service (cfssl-ocspserve@dse)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@dse]']
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem].orig
+++ File[/etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem.orig
+++ /etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem
@@ -1 +0,0 @@
-##### FAKE FOR PUPPET ######

Exec[Generate initial CRL for wikikube_front_proxy]

Parameters differences:

--- Exec[Generate initial CRL for wikikube_front_proxy].orig
+++ Exec[Generate initial CRL for wikikube_front_proxy]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/wikikube_front_proxy
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/wikikube_front_proxy

Sudo::User[nrpe_certificate_check_wikikube_staging_front_proxy]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_wikikube_staging_front_proxy].orig
+++ Sudo::User[nrpe_certificate_check_wikikube_staging_front_proxy]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_wikikube_staging_front_proxy

File[/etc/apache2/mods-enabled/status.conf]

Parameters differences:

--- File[/etc/apache2/mods-enabled/status.conf].orig
+++ File[/etc/apache2/mods-enabled/status.conf]

-    require => Package[apache2]
-    ensure  => absent
-    before  => Httpd::Mod_conf[status]
-    owner   => root
-    group   => root

Systemd::Service[nrpe2nodexp-check_certificate_expiry_cassandra]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_cassandra].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_cassandra]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_mlserve_staging]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_aux.service

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Unit[cfssl-ocsprefresh-discovery2026.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-discovery2026.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-discovery2026.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-discovery2026.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Prometheus::Node_textfile[prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-syslog-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-syslog-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-syslog-certificate-expiry --cert-path /etc/cfssl/signers/syslog/ca/syslog.pem --outfile /var/lib/prometheus/node.d/syslog_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_7cff186656c3cabbca85b5b57d0c8679]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_7cff186656c3cabbca85b5b57d0c8679].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_staging_7cff186656c3cabbca85b5b57d0c8679]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_mlserve_staging))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_staging
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_staging
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="7cff186656c3cabbca85b5b57d0c8679",check_name="check_check_certificate_expiry_mlserve_staging", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__mlserve_staging
-    group              => nrpechecks
-    severity           => info

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_mlserve]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cassandra]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cassandra].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cassandra]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_cassandra.service

File[/etc/sudoers.d/nrpe_certificate_check_aux]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_aux].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_aux]

-    owner  => root
-    group  => root
-    ensure => absent

File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Class[Monitoring]

Parameters differences:

--- Class[Monitoring].orig
+++ Class[Monitoring]

@@
-    notifications_enabled => True
+    notifications_enabled => False
@@
-    cluster               => pki
+    cluster               => insetup
@@
-    nagios_group          => pki_eqiad
+    nagios_group          => insetup_eqiad

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_puppet_rsa.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_puppet_rsa]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem

File[/etc/apache2/conf-available]

Parameters differences:

--- File[/etc/apache2/conf-available].orig
+++ File[/etc/apache2/conf-available]

-    mode    => 0755
-    require => Package[apache2]
-    ensure  => directory
-    owner   => root
-    group   => root

Nrpe::Check[check_check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Nrpe::Check[check_check_certificate_expiry_mlserve_staging_front_proxy]

-    before    => Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem

File[/etc/cfssl/ocsp/cassandra.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/cassandra.ocsp].orig
+++ File[/etc/cfssl/ocsp/cassandra.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Profile::Pki::Multirootca::Monitoring[wikikube]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[wikikube].orig
+++ Profile::Pki::Multirootca::Monitoring[wikikube]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/wikikube/ca/wikikube.pem
-    intermediate => wikikube

Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery -profile ocsp /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet

Cfssl::Config[syslog]

Parameters differences:

--- Cfssl::Config[syslog].orig
+++ Cfssl::Config[syslog]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/syslog
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/syslog/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/syslog

File[/etc/cfssl/signers/debmonitor/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/debmonitor/cfssl.conf].orig
+++ File[/etc/cfssl/signers/debmonitor/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/debmonitor/cfssl.conf.orig
+++ /etc/cfssl/signers/debmonitor/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/debmonitor",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/debmonitor"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Service[cfssl-ocspserve@syslog]

Parameters differences:

--- Service[cfssl-ocspserve@syslog].orig
+++ Service[cfssl-ocspserve@syslog]

-    ensure => running
-    enable => True

Service[cfssl-ocspserve@wikikube_staging_front_proxy]

Parameters differences:

--- Service[cfssl-ocspserve@wikikube_staging_front_proxy].orig
+++ Service[cfssl-ocspserve@wikikube_staging_front_proxy]

-    ensure => running
-    enable => True

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]
-    ensure   => present
-    priority => 40

Systemd::Service[cfssl-ocspserve@puppet_rsa]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@puppet_rsa].orig
+++ Systemd::Service[cfssl-ocspserve@puppet_rsa]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_staging_front_proxy command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "b194b5b9b6c9d6e05b9eed8dcfcc40cf" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_staging_front_proxy"

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_debmonitor]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_debmonitor].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_debmonitor]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_debmonitor!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: debmonitor
-    check_interval         => 1

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-zuul.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-zuul" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-zuul/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label debmonitor -profile ocsp /etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet

Logrotate::Conf[cfssl-ocsprefresh-syslog]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-syslog].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-syslog]

-    ensure => present

Motd::Script[pki::multirootca]

Parameters differences:

--- Motd::Script[pki::multirootca].orig
+++ Motd::Script[pki::multirootca]

-    ensure   => present
-    priority => 5

Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/cfssl/signers/mlserve/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve/cfssl.conf].orig
+++ File[/etc/cfssl/signers/mlserve/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/mlserve/cfssl.conf.orig
+++ /etc/cfssl/signers/mlserve/cfssl.conf
@@ -1,81 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/mlserve",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/mlserve"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "service-account-management": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment"
-        ]
-      },
-      "prometheus": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Profile::Pki::Multirootca::Monitoring[wikikube_staging_front_proxy]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[wikikube_staging_front_proxy].orig
+++ Profile::Pki::Multirootca::Monitoring[wikikube_staging_front_proxy]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
-    intermediate => wikikube_staging_front_proxy

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_front_proxy command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "4d759acaf0fd7dd3abaa03dc4565aef6" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_front_proxy"

Systemd::Unit[cfssl-ocspserve@wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@wikikube_staging_front_proxy].orig
+++ Systemd::Unit[cfssl-ocspserve@wikikube_staging_front_proxy]

-    override          => False
-    unit              => cfssl-ocspserve@wikikube_staging_front_proxy
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

File[/usr/local/bin/prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-kafka-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-kafka-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cassandra]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cassandra].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cassandra]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_cassandra!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: cassandra
-    check_interval         => 1

File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_syslog]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_syslog].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_syslog]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_syslog!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: syslog
-    check_interval         => 1

Systemd::Syslog[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Rsyslog::Conf[nrpe2nodexp-check_cfssl-multirootca_status]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_cfssl-multirootca_status].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_cfssl-multirootca_status]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Service[cfssl-ocspserve@zuul]

Parameters differences:

--- Service[cfssl-ocspserve@zuul].orig
+++ Service[cfssl-ocspserve@zuul]

-    ensure => running
-    enable => True

Prometheus::Blackbox::Check::Http[PKI_network_devices]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_network_devices].orig
+++ Prometheus::Blackbox::Check::Http[PKI_network_devices]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"network_devices"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Cfssl::Cert[OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_front_proxy]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => wikikube_front_proxy
-    notify          => Service[cfssl-ocspserve@wikikube_front_proxy]
-    profile         => ocsp

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_zuul.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_zuul]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem

File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA
-
-/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-cassandra.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_cassandra" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/usr/local/bin/apache-status]

Parameters differences:

--- File[/usr/local/bin/apache-status].orig
+++ File[/usr/local/bin/apache-status]

-    mode   => 0555
-    owner  => root
-    source => puppet:///modules/httpd/apache-status
-    group  => root

Systemd::Service[cfssl-multirootca]

Parameters differences:

--- Systemd::Service[cfssl-multirootca].orig
+++ Systemd::Service[cfssl-multirootca]

-    override                 => False
-    unit_type                => service
-    migration_task           => T350694
-    monitoring_critical      => True
-    restart                  => True
-    ensure                   => present
-    service_params           => {}
-    monitoring_notes_url     => https://wikitech.wikimedia.org/wiki/PKI
-    monitoring_enabled       => True
-    monitoring_contact_group => admins

File[/etc/cfssl/ocsp/cloud_wmnet_ca.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/cloud_wmnet_ca.ocsp].orig
+++ File[/etc/cfssl/ocsp/cloud_wmnet_ca.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse_front_proxy].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service

Cfssl::Cert[OCSP_mlserve_staging_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_mlserve_staging_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_mlserve_staging_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => mlserve_staging
-    notify          => Service[cfssl-ocspserve@mlserve_staging]
-    profile         => ocsp

Systemd::Unit[apache2-apache2-after-network-online-target]

Parameters differences:

--- Systemd::Unit[apache2-apache2-after-network-online-target].orig
+++ Systemd::Unit[apache2-apache2-after-network-online-target]

-    override          => True
-    unit              => apache2
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => apache2-after-network-online-target

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service

Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label zuul -profile ocsp /etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - mlserve_staging
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --responses-file /etc/cfssl/ocsp/mlserve_staging.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_staging' mlserve_staging

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Sudo::User[nrpe-check_check_certificate_expiry_discovery]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_discovery].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_discovery]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem']
-    user       => nagios

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-mlserve-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-mlserve-certificate-expiry --cert-path /etc/cfssl/signers/mlserve/ca/mlserve.pem --outfile /var/lib/prometheus/node.d/mlserve_intermediate.prom

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_dse_front_proxy.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_dse_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-mlserve_staging-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_intermediate.prom

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Cfssl::Signer[mlserve_staging]

Parameters differences:

--- Cfssl::Signer[mlserve_staging].orig
+++ Cfssl::Signer[mlserve_staging]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDsjCCAxOgAwIBAgIUHWrqd3I2VME7z6A5M3brKa5UlOgwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB9
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRgwFgYDVQQDDA9tbHNlcnZlX3N0YWdpbmcwgZswEAYHKoZIzj0CAQYFK4EE
ACMDgYYABAAu0g2dBBEAH2iUfZLPv+mA+1srb6S3bdVyH/kRk+QZDoOMnM0H8Edn
V+dakFKXnwl+w+qsOsWj1NP2FlOm3bTglwCIxFAzX5XaDfqWa74L1tIqDH6kx+bX
yxnuGWT/U1cv8rIHFap7ccH3h5YxPQfHy73KRTWxPln6ByswgxekotwnCKOCAQww
ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
BBSRzdapYuh57Gp5MstVlUJNJ+6zTzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
AY8VuLFo6MpcfxrDG8Junk8mESfQTMRbfeZM6WpHqKYBTESkpeV8HIdTYliFDAMX
JqE94+xbPVaTS8DZ0xiXz4SjAkIBEIIXA4nOdLYbX/MvdKWr7aDunH8n1oO3K/op
7NktfJd5CXuECxdSonHOb7PFW5lbpCtZrLxFzhB2Hlp1TBWHX84=
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/mlserve_staging
-    db_host          => localhost
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => nosecret

-    ca_file          => /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    ca_key_file      => /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 72h
-    default_crl_url  => http://pki.discovery.wmnet/crl/mlserve_staging
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_cloud_wmnet_ca command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "f87f54115f2f782169eed72541c30a1e" --timeout 10 --check-command "check_check_certificate_expiry_cloud_wmnet_ca"

File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]
-    ensure   => present
-    priority => 40

Prometheus::Blackbox::Check::Http[PKI_wikikube]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_wikikube].orig
+++ Prometheus::Blackbox::Check::Http[PKI_wikikube]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"wikikube"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Cfssl::Ocsp[network_devices]

Parameters differences:

--- Cfssl::Ocsp[network_devices].orig
+++ Cfssl::Ocsp[network_devices]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 20063
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/network_devices/ca/network_devices.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

File[/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

File[/etc/cfssl/signers/cassandra/ca/cassandra.pem]

Parameters differences:

--- File[/etc/cfssl/signers/cassandra/ca/cassandra.pem].orig
+++ File[/etc/cfssl/signers/cassandra/ca/cassandra.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/cassandra/ca/cassandra.pem.orig
+++ /etc/cfssl/signers/cassandra/ca/cassandra.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqjCCAw2gAwIBAgIUN8PPoG0JeyUfDWKQhN0B2AOw4G8wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjE5MTI1MDAwWhcNMjgwNjE3MTI1MDAwWjB3
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRIwEAYDVQQDEwljYXNzYW5kcmEwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
-BABpd+xtElegZM2bsg1caGxmHV5hs7l7qxmKFS3oSAu1jo1+N/uSppDtSWZzG+8C
-zjIrytBMxBWhNqsOw9msEWhbBAEYESw1oKj+APqOlCafGdXQI1ZvMafexxTqDNN1
-CA2gq4ivn82r2Ya3LLqwICxK3MlcmGuLwR5amxiLchok3cZ3X6OCAQwwggEIMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQBN6m6
-eyaSV8l2Il/bwcfpWTmplDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
-NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
-ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
-BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
-ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GKADCBhgJBRhCSOg5L
-+EuYGdsW8T9S/tXzYURZpnQItn2nYjM6ky1nxqG6F+V2WsiijiPpEQxr7QUvfZhf
-D2zhB5BS8ynWCpYCQRGo4eZuUHyRMNqg/ZDljT1dqr09n0wQhszrJ4eCmebLVsDm
-B6AM3pPRygYo0REwxHbpTBAIt26zjGiKiFQqUjwa
------END CERTIFICATE-----

Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - mlserve_staging
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --responses-file /etc/cfssl/ocsp/mlserve_staging.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_staging' mlserve_staging

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging-front-proxy.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_network_devices.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_network_devices]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem

File[/etc/cfssl/signers/etcd/ca]

Parameters differences:

--- File[/etc/cfssl/signers/etcd/ca].orig
+++ File[/etc/cfssl/signers/etcd/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@discovery2026]']
-    command     => /bin/systemctl daemon-reload

File[/var/log/cfssl-ocsprefresh-cassandra]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-cassandra].orig
+++ File[/var/log/cfssl-ocsprefresh-cassandra]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Ferm::Service[multirootca_tls_termination]

Parameters differences:

--- Ferm::Service[multirootca_tls_termination].orig
+++ Ferm::Service[multirootca_tls_termination]

-    desc                => 
-    prio                => 10
-    unrestricted_access => False
-    src_sets            => ['DOMAIN_NETWORKS']
-    proto               => tcp
-    port                => 443
-    ensure              => present
-    notrack             => False

Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-mlserve_front_proxy.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_debmonitor]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_debmonitor].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_debmonitor]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Service[nrpe2nodexp-check_certificate_expiry_syslog.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_syslog.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_syslog.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]']

File[/etc/logrotate.d/cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-debmonitor].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-debmonitor]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-debmonitor.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-debmonitor
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-debmonitor
-
-/var/log/cfssl-ocsprefresh-debmonitor/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_etcd.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Timer[cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-aux_front_proxy].orig
+++ Systemd::Timer[cfssl-ocsprefresh-aux_front_proxy]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-aux_front_proxy.service

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_etcd]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_etcd].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_etcd]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_etcd!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: etcd
-    check_interval         => 1

Systemd::Syslog[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Cfssl::Cert[OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging_front_proxy]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => wikikube_staging_front_proxy
-    notify          => Service[cfssl-ocspserve@wikikube_staging_front_proxy]
-    profile         => ocsp

Cfssl::Config[kafka]

Parameters differences:

--- Cfssl::Config[kafka].orig
+++ Cfssl::Config[kafka]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/kafka
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/kafka/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'kafka_11': {'expiry': '8760h'}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/kafka

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-wikikube_staging_front_proxy.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/cfssl-gc-expired-certs.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-gc-expired-certs.timer].orig
+++ File[/lib/systemd/system/cfssl-gc-expired-certs.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)]

Content differences:

--- /lib/systemd/system/cfssl-gc-expired-certs.timer.orig
+++ /lib/systemd/system/cfssl-gc-expired-certs.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-gc-expired-certs.service
-
-[Timer]
-Unit=cfssl-gc-expired-certs.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=hourly
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Sudo::User[nrpe-check_check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_mlserve_front_proxy].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_mlserve_front_proxy]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem']
-    user       => nagios

Nrpe::Monitor_service[check_cfssl-multirootca_status]

Parameters differences:

--- Nrpe::Monitor_service[check_cfssl-multirootca_status].orig
+++ Nrpe::Monitor_service[check_cfssl-multirootca_status]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI
-    description                 => Check unit status of cfssl-multirootca
-    nrpe2nodexp_parse_perf_data => False
-    alertmanager_team           => observability
-    nrpe_command                => /usr/local/lib/nagios/plugins/check_systemd_unit_status cfssl-multirootca
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    critical                    => True
-    retries                     => 2
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 10

Cfssl::Cert[OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => cloud_wmnet_ca
-    notify          => Service[cfssl-ocspserve@cloud_wmnet_ca]
-    profile         => ocsp

Nrpe::Monitor_service[check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_puppet_rsa].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_puppet_rsa]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: puppet_rsa
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

File[/lib/systemd/system/cfssl-ocspserve@debmonitor.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@debmonitor.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@debmonitor.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@debmonitor.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@debmonitor.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (debmonitor)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10001 \
-          -responses /etc/cfssl/ocsp/debmonitor.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Cfssl::Signer[discovery]

Parameters differences:

--- Cfssl::Signer[discovery].orig
+++ Cfssl::Signer[discovery]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDrDCCAw2gAwIBAgIUcVMxEVtp5xErDjx/jInOFcUaRjkwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjEwNTA0MTM1NDAwWhcNMjYwNTAzMTM1NDAwWjB3
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRIwEAYDVQQDEwlkaXNjb3ZlcnkwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
BAG7X6lQ05D8EQYwPd+v2qT12Y35j/YQTaOEbAuKQJBshTdMizCxGe4GUB33Nivw
3B0o9EcyCQokcUCUGtVlI3U0QQArB+LuehDTw7D5JKwOUK5GpSG5YlNL7Kg2c3gI
wyck1+Z5yDMIsclW5FtaM1IIFeUIOXrulmih3zM4PPrVtP3Vh6OCAQwwggEIMA4G
A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSJ76Rw
5IjvCdxrdGkh4PHUL7PCBjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAeamwKAw
q+lKC/GdcPuP2SOoyij0+LFWucrQwxxiCiXlMAhSnj3fkKk5G5pLoFnY2X7hB0w4
ZPtLXG7If9pmIDjwAkIBwnJUYLz3dJTbZudeUJFX4yD49liKTYMPDpl/HWKSh9m4
4PZKXsAIs4CT29jwwtmsLK1HkPB0ShO8Egm/KB5dLUs=
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/discovery
-    db_host          => localhost
-    default_usages   => ['digital signature', 'key encipherment', 'server auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => ##### FAKE FOR PUPPET ######

-    ca_file          => /etc/cfssl/signers/discovery/ca/discovery.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}
-    ca_key_file      => /etc/cfssl/signers/discovery/ca/discovery-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/discovery
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Systemd::Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/cfssl/db.conf.json]

Parameters differences:

--- File[/etc/cfssl/db.conf.json].orig
+++ File[/etc/cfssl/db.conf.json]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/db.conf.json.orig
+++ /etc/cfssl/db.conf.json
@@ -1,12 +0,0 @@
-{
-  "host": "m1-master.eqiad.wmnet",
-  "port": 3306,
-  "user": "pki",
-  "password": "changeme",
-  "db": "pki",
-  "charset": "utf8mb4",
-  "ssl": {
-    "ca": "/etc/ssl/certs/wmf-ca-certificates.crt",
-    "check_hostname": false
-  }
-}

File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/etc/cfssl/signers/discovery2026/ca]

Parameters differences:

--- File[/etc/cfssl/signers/discovery2026/ca].orig
+++ File[/etc/cfssl/signers/discovery2026/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/var/log/cfssl-ocsprefresh-etcd]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-etcd].orig
+++ File[/var/log/cfssl-ocsprefresh-etcd]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Service[cfssl-ocspserve@aux]

Parameters differences:

--- Service[cfssl-ocspserve@aux].orig
+++ Service[cfssl-ocspserve@aux]

-    ensure => running
-    enable => True

Systemd::Timer::Job[cfssl-ocsprefresh-zuul]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-zuul].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-zuul]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - zuul
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/zuul/ca/zuul.pem --responses-file /etc/cfssl/ocsp/zuul.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@zuul' zuul

Nrpe::Monitor_service[check_certificate_expiry_debmonitor]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_debmonitor].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_debmonitor]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: debmonitor
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

File[/srv/cfssl/bundles]

Parameters differences:

--- File[/srv/cfssl/bundles].orig
+++ File[/srv/cfssl/bundles]

-    owner  => root
-    group  => root
-    ensure => directory

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-kafka.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_kafka" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/etc/logrotate.d/cfssl-ocsprefresh-syslog]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-syslog].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-syslog]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-syslog.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-syslog
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-syslog
-
-/var/log/cfssl-ocsprefresh-syslog/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-wikikube_front_proxy.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp].orig
+++ File[/etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

File[/etc/apache2/env-available]

Parameters differences:

--- File[/etc/apache2/env-available].orig
+++ File[/etc/apache2/env-available]

-    mode    => 0755
-    require => Package[apache2]
-    ensure  => directory
-    owner   => root
-    group   => root

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_debmonitor.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_debmonitor.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/etc/sudoers.d/nrpe_certificate_check_wikikube_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_wikikube_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_wikikube_front_proxy]

-    owner  => root
-    group  => root
-    ensure => absent

Rsyslog::Conf[cfssl-ocsprefresh-wikikube]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-wikikube].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-wikikube]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-wikikube]
-    ensure   => present
-    priority => 40

Systemd::Service[cfssl-ocsprefresh-aux]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-aux].orig
+++ Systemd::Service[cfssl-ocsprefresh-aux]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-aux.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Systemd::Syslog[cfssl-ocsprefresh-mlserve]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-mlserve].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-mlserve]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Cfssl::Config[debmonitor]

Parameters differences:

--- Cfssl::Config[debmonitor].orig
+++ Cfssl::Config[debmonitor]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/debmonitor
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/debmonitor/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/debmonitor

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_kafka command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_kafka
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "22922fd6bc2d570e018cbe5ccd8d1727" --timeout 10 --check-command "check_check_certificate_expiry_kafka"

Nrpe::Check[check_check_certificate_expiry_discovery2026]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_discovery2026].orig
+++ Nrpe::Check[check_check_certificate_expiry_discovery2026]

-    before    => Monitoring::Service[check_certificate_expiry_discovery2026]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem

Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@cassandra]']
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Nrpe::Check[check_check_cfssl-multirootca_status]

Parameters differences:

--- Nrpe::Check[check_check_cfssl-multirootca_status].orig
+++ Nrpe::Check[check_check_cfssl-multirootca_status]

-    command => /usr/local/lib/nagios/plugins/check_systemd_unit_status cfssl-multirootca
-    ensure  => present
-    before  => Monitoring::Service[check_cfssl-multirootca_status]

Systemd::Service[cfssl-ocsprefresh-network_devices]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-network_devices].orig
+++ Systemd::Service[cfssl-ocsprefresh-network_devices]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-network_devices.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer)]']

File[/etc/apache2/conf-enabled]

Parameters differences:

--- File[/etc/apache2/conf-enabled].orig
+++ File[/etc/apache2/conf-enabled]

-    owner   => root
-    recurse => True
-    purge   => True
-    mode    => 0755
-    require => Package[apache2]
-    ensure  => directory
-    group   => root
-    notify  => Service[apache2]

Prometheus::Alert::Rule[check_check_certificate_expiry_dse_4384c5ebc49e03dbe331e279fac3f393]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_dse_4384c5ebc49e03dbe331e279fac3f393].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_dse_4384c5ebc49e03dbe331e279fac3f393]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_dse))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: dse
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: dse
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="4384c5ebc49e03dbe331e279fac3f393",check_name="check_check_certificate_expiry_dse", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__dse
-    group              => nrpechecks
-    severity           => info

Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-cloud_wmnet_ca.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/signers/puppet_rsa]

Parameters differences:

--- File[/etc/cfssl/signers/puppet_rsa].orig
+++ File[/etc/cfssl/signers/puppet_rsa]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_cassandra
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    ensure => present

Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse -profile ocsp /etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet

Prometheus::Node_textfile[prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-aux-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-aux-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-aux-certificate-expiry --cert-path /etc/cfssl/signers/aux/ca/aux.pem --outfile /var/lib/prometheus/node.d/aux_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging_front_proxy.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_wikikube_staging_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem

File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Systemd::Unit[cfssl-ocspserve@discovery]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@discovery].orig
+++ Systemd::Unit[cfssl-ocspserve@discovery]

-    override          => False
-    unit              => cfssl-ocspserve@discovery
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Cfssl::Config[mlserve_staging_front_proxy]

Parameters differences:

--- Cfssl::Config[mlserve_staging_front_proxy].orig
+++ Cfssl::Config[mlserve_staging_front_proxy]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/mlserve_staging_front_proxy
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_expiry      => 72h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/mlserve_staging_front_proxy

File[/etc/cfssl/ocsp/debmonitor.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/debmonitor.ocsp].orig
+++ File[/etc/cfssl/ocsp/debmonitor.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Systemd::Timer[cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-mlserve_staging].orig
+++ Systemd::Timer[cfssl-ocsprefresh-mlserve_staging]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-mlserve_staging.service

File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem].orig
+++ File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem.orig
+++ /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem
@@ -1 +0,0 @@
-test

Systemd::Unit[cfssl-ocsprefresh-discovery.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-discovery.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-discovery.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-discovery.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/signers/dse_front_proxy/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/dse_front_proxy/cfssl.conf].orig
+++ File[/etc/cfssl/signers/dse_front_proxy/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/dse_front_proxy/cfssl.conf.orig
+++ /etc/cfssl/signers/dse_front_proxy/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/dse_front_proxy",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/dse_front_proxy"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Nrpe::Monitor_service[check_certificate_expiry_mlserve]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_mlserve].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_mlserve]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: mlserve
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

Logrotate::Conf[cfssl-ocsprefresh-network_devices]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-network_devices].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-network_devices]

-    ensure => present

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_kafka]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_kafka].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_kafka]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Monitoring::Service[check_certificate_expiry_wikikube]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_wikikube].orig
+++ Monitoring::Service[check_certificate_expiry_wikikube]

-    check_command  => nrpe_check!check_check_certificate_expiry_wikikube!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: wikikube
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_staging_front_proxy command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "b194b5b9b6c9d6e05b9eed8dcfcc40cf" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_staging_front_proxy"

Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Service[cfssl-ocspserve@kafka]

Parameters differences:

--- Service[cfssl-ocspserve@kafka].orig
+++ Service[cfssl-ocspserve@kafka]

-    ensure => running
-    enable => True

Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_debmonitor.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_debmonitor]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/dse/ca/dse.pem]

Parameters differences:

--- File[/etc/cfssl/signers/dse/ca/dse.pem].orig
+++ File[/etc/cfssl/signers/dse/ca/dse.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/dse/ca/dse.pem.orig
+++ /etc/cfssl/signers/dse/ca/dse.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpTCCAwegAwIBAgIUb4Tdc/LBMz08oj3vXm9vyvVoa8kwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjBx
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQwwCgYDVQQDEwNkc2UwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAEKIsRi
-rMZazQ75DhhEGhtUEr3248uYpcVNJ3Mp/1IdsIkgdy3vU97D4x+FWvbcITOzw9xz
-apIVnwWIAU7hei4jEwCAIr3llako75gtbD7Xvq9y6UDUcp/LOGBkmGMBktL2Q9qz
-Dgc4AgI29X2/hGBuYEglW2Qhpnbu0+q+7Xi/eKSG3aOCAQwwggEIMA4GA1UdDwEB
-/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSp3KLmcR8APKuf
-wQNUAmw4ugiWrzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
-BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
-bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
-oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
-bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCBhwJCAYGa4oeqY5OQzJhU
-JqhW7Wn0V5dXQ3F0LJKbf70afe5Xx/jkMKMXv6cpUoCgq6OW5CzFHvwyYGDYc3Uy
-Dj63k3tQAkFP3CHPBJahbaziMXpat5mFpYeRit/bScad+W+ysdXe4wLSRK3skzhU
-pOp2n7NgGJQbM1fWuRcBPMQLEZVFsbo04A==
------END CERTIFICATE-----

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_debmonitor
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/debmonitor/ca/debmonitor.pem

Cfssl::Signer[zuul]

Parameters differences:

--- Cfssl::Signer[zuul].orig
+++ Cfssl::Signer[zuul]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDpzCCAwigAwIBAgIUMIxkteGnxVGRNFWjJZ+eXPnOeM8wCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjUwODIwMTg1NTAwWhcNMzAwODE5MTg1NTAwWjBy
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMQ0wCwYDVQQDEwR6dXVsMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBNx/m
dSpc4EWI68Y36PVvDkvyqlJ6pA4sEXQCrNOM+0jSACRM8Shwqr7uC/JmuP8GIdK3
g+SgxQOjF9pfelX2OpAB6leOfgHXhFtzJquX261tKsxQm74cszycF9YTiWDKVq0V
g7bFNgf4NcC7NxGfN4SuA58I7dQWJxSWdzTJNQsF2uijggEMMIIBCDAOBgNVHQ8B
Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUqyQEoVfbsJqL
jr5RyZovCpWdRZUwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgER9R3mwAtzYcIh
HAnL2SiHTXBpqitQp6Ce+7nYFP0qyu+Ggkx2bu86bl32lGmvA6ecTKXDiyXW5pMW
atmKn0wAegJCAaU9pfWuLIgsVqzB2zvDWMR2HgBMa6MO7dRlG2VUoLvR16NF9cln
XjNzIqPRxUpiD5TNC4+p9BoT+RRXEDUeRufH
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/zuul
-    db_host          => localhost
-    default_usages   => ['server auth', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => nosecret

-    ca_file          => /etc/cfssl/signers/zuul/ca/zuul.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    ca_key_file      => /etc/cfssl/signers/zuul/ca/zuul-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/zuul
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Prometheus::Blackbox::Check::Http[PKI_mlserve]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_mlserve].orig
+++ Prometheus::Blackbox::Check::Http[PKI_mlserve]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"mlserve"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem].orig
+++ File[/etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem.orig
+++ /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem
@@ -1 +0,0 @@
-test

Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service

File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/logrotate.d/cfssl-ocsprefresh-cassandra]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-cassandra].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-cassandra]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-cassandra.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-cassandra
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-cassandra
-
-/var/log/cfssl-ocsprefresh-cassandra/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Service[nrpe2nodexp-check_certificate_expiry_cassandra.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_cassandra.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_cassandra.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]']

Cfssl::Signer[wikikube_front_proxy]

Parameters differences:

--- Cfssl::Signer[wikikube_front_proxy].orig
+++ Cfssl::Signer[wikikube_front_proxy]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDuDCCAxmgAwIBAgIUCqmj+2MwaOqLPb5TPXkbkF/PGkUwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
gjELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
aW9uczEdMBsGA1UEAwwUd2lraWt1YmVfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0C
AQYFK4EEACMDgYYABAAUuXSlLM/Sq6jmsr6/+aqYnBNDoelW5+uJ8kWFyR/9xaFf
hmvvui358ZLmOym6cA1tpoA1+PVZ1sVOE++GDsWQ3QDAG2kk8o0QxpXsCXLWBmJZ
92Z/pIO7Fc65qe6XDnuZLEaqbb6VWkqQPI15cL9AhJ8HgNbaoaxrT51MfCrHEteP
raOCAQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0G
A1UdDgQWBBTlGjpQ7L1N14lCjcKcI/4LLNraBjAfBgNVHSMEGDAWgBQ7raJx5jS9
G/yAvzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6
Ly9wa2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jv
b3RfQ0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21u
ZXQvY3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GM
ADCBiAJCAYT0XLJdjumemn8jpqv058zb+c+3zb+05EhNcj15wcjRUq8SU+c2+H8a
hzfph97+CVSvGaV6Cf7phTSEBDPk9+T4AkIBdOmzIcRH+K9UcDzvdxqerOiXJaBC
0Bgbg9dOhcd6d0j3CObOuIp760FFQLSli2ocG3WLkfNsXlL1/3+VL+yarNo=
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/wikikube_front_proxy
-    db_host          => localhost
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => test

-    ca_file          => /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    ca_key_file      => /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/wikikube_front_proxy
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem].orig
+++ File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem.orig
+++ /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
@@ -1,23 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDvjCCAyCgAwIBAgIUV8ha2UdjViI49Xr/fZzbY4YPZdYwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
-iTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczEkMCIGA1UEAwwbbWxzZXJ2ZV9zdGFnaW5nX2Zyb250X3Byb3h5MIGbMBAG
-ByqGSM49AgEGBSuBBAAjA4GGAAQAyrMiWBRjOWCaMXsvXC0wS6VzHyLLGFT8BpM9
-EhYcloDfNnb8no2+YXrBzj4+lAg3D3dq53q+hyHko3+YsVVF/qABa55syWkYtxDB
-xy5FNq6Iq/s2E3vO2YpQifWXlaSZvvuZCGhhTPDOp/zdI/kKdco9Jehsu6CdyElj
-lCgJTZupZCmjggEMMIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB
-/wIBATAdBgNVHQ4EFgQUj5l8xt65hr4t5yj8xKYmUsKwk9YwHwYDVR0jBBgwFoAU
-O62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzAB
-hjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRl
-cm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292
-ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjO
-PQQDBAOBiwAwgYcCQgD24XA2cP2pFwE3onWEosbFqDEaFwD5kNg7eSOkncJIceFU
-bCX1f6VOYSv6UbiEQV0EwS0d34EawydbLcqXqfHgpgJBJJjdNhpjAcwyRt1+unRc
-dYn6ys1ZElRXMld7NUq+nCInX5cVk8uPeSev6IxIJc2eyBCb4jtjvE3TAQ2RHvT9
-sBI=
------END CERTIFICATE-----

Exec[ensure_present_mod_ssl]

Parameters differences:

--- Exec[ensure_present_mod_ssl].orig
+++ Exec[ensure_present_mod_ssl]

-    require => Package[apache2]
-    creates => /etc/apache2/mods-enabled/ssl.load
-    notify  => Service[apache2]
-    command => /usr/sbin/a2enmod ssl

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem

Nrpe::Monitor_service[check_certificate_expiry_kafka]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_kafka].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_kafka]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: kafka
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]
-    ensure   => present
-    priority => 40

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/var/lib/prometheus/node.d/check_check_cfssl-multirootca_status.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_cfssl-multirootca_status.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_cfssl-multirootca_status.prom]

-    owner  => root
-    group  => root
-    ensure => absent

File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem].orig
+++ File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem.orig
+++ /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem
@@ -1 +0,0 @@
-nosecret

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-cassandra.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-cassandra" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-cassandra/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_etcd.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-discovery2026.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-discovery2026.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - discovery2026
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --responses-file /etc/cfssl/ocsp/discovery2026.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery2026' discovery2026

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cloud_wmnet_ca -profile ocsp /etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet

Cfssl::Signer[wikikube_staging]

Parameters differences:

--- Cfssl::Signer[wikikube_staging].orig
+++ Cfssl::Signer[wikikube_staging]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDsTCCAxSgAwIBAgIUKJGxrsUkuGnKTwrJIdYlm1ZK6uMwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB+
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRkwFwYDVQQDDBB3aWtpa3ViZV9zdGFnaW5nMIGbMBAGByqGSM49AgEGBSuB
BAAjA4GGAAQBJQPiRDYxLnr33KdzugCHk21yjDhyRHMrAIJ0qGmasdcMNZpK9P9u
6ISJRfTC73WiKOSSWBuJAhsdK2Y7hIoUOikAexL5MOVOFAK8MtWXx6j7MmuuPGnC
MIyIk1pqxzoacZWJ8uJe/WGw/Udd/RPxAfsxN8loKKT0+zs3WzGw63saO6yjggEM
MIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4E
FgQU8bcT1hszDpGqcobdFXNOugsbu0MwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81
cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtp
LmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NB
MEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2Ny
bC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYC
QTKbWZ4u9V6ei9rgB4XXyyVEzIZMgVCdwuytcmqEaB9ZavqjYsdrgTOsgcy2Jw1C
id1Sw/9g5YpcZBLaXh52CuNVAkFnnXo7+fe5kgOs2vTIsbIG4huh6ftI/8bmIdr2
9FHm9FXlmSIDWQIn7Fq4TFLVmiatI/TdiGK+n3oT/st73jwn1A==
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/wikikube_staging
-    db_host          => localhost
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => test

-    ca_file          => /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    ca_key_file      => /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 72h
-    default_crl_url  => http://pki.discovery.wmnet/crl/wikikube_staging
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem].orig
+++ File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem.orig
+++ /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsTCCAxSgAwIBAgIUKJGxrsUkuGnKTwrJIdYlm1ZK6uMwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB+
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRkwFwYDVQQDDBB3aWtpa3ViZV9zdGFnaW5nMIGbMBAGByqGSM49AgEGBSuB
-BAAjA4GGAAQBJQPiRDYxLnr33KdzugCHk21yjDhyRHMrAIJ0qGmasdcMNZpK9P9u
-6ISJRfTC73WiKOSSWBuJAhsdK2Y7hIoUOikAexL5MOVOFAK8MtWXx6j7MmuuPGnC
-MIyIk1pqxzoacZWJ8uJe/WGw/Udd/RPxAfsxN8loKKT0+zs3WzGw63saO6yjggEM
-MIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4E
-FgQU8bcT1hszDpGqcobdFXNOugsbu0MwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81
-cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtp
-LmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NB
-MEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2Ny
-bC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYC
-QTKbWZ4u9V6ei9rgB4XXyyVEzIZMgVCdwuytcmqEaB9ZavqjYsdrgTOsgcy2Jw1C
-id1Sw/9g5YpcZBLaXh52CuNVAkFnnXo7+fe5kgOs2vTIsbIG4huh6ftI/8bmIdr2
-9FHm9FXlmSIDWQIn7Fq4TFLVmiatI/TdiGK+n3oT/st73jwn1A==
------END CERTIFICATE-----

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Systemd::Service[cfssl-ocspserve@debmonitor]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@debmonitor].orig
+++ Systemd::Service[cfssl-ocspserve@debmonitor]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

File[/etc/cfssl/signers/kafka/ca]

Parameters differences:

--- File[/etc/cfssl/signers/kafka/ca].orig
+++ File[/etc/cfssl/signers/kafka/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Exec[renew certificate - OCSP_syslog_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_syslog_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_syslog_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label syslog -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet

File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Logrotate::Conf[cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-wikikube_front_proxy]

-    ensure => present

File[/etc/cfssl/signers/dse_front_proxy]

Parameters differences:

--- File[/etc/cfssl/signers/dse_front_proxy].orig
+++ File[/etc/cfssl/signers/dse_front_proxy]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Logrotate::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    ensure => present

Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa -profile ocsp /etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet

File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Systemd::Unit[cfssl-ocsprefresh-dse.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-dse.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-dse.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-dse.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem]

Parameters differences:

--- File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem].orig
+++ File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem.orig
+++ /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUBGeKXglKnoXGyRgWodaHSfz0z/gwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9kc2VfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABAGUNx07sN1MWk3DzjEFh3pfYaQVrqo1tWFQjf7URfwqfyZY81Tqt6yl
-y/zj3DpvtOmvyI5jPH91yPBaFho0/SpP6wFkBIyE8/Ik2b80slPKuzstrYgBlYsG
-+Fxop4CYWjLItOy1Ut82aYr76hNm0goEma9ETjgE4nfBEU3vi77QO/B9E6OCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBQPHxMmkuy8EqO+Wz7TmM1MfmcXDDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-AO3JNb9OyC3JQ3mmkgt+Db3NMgLArYlvcYd8Nd5uWEXm6d6NfUPDN5XBGkjly1B7
-N18vKQYxlZzX2wgYqaK9LYs9AkIBch3vTND/M2T78Hhp5YoodasCdLDcpMJ1Qn3T
-fI0Lwjt7W50T0FMle6CwZkI+ZrxRzqvic19IUSTDDqwiOFgLhqM=
------END CERTIFICATE-----

Systemd::Service[nrpe2nodexp-check_certificate_expiry_zuul]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_zuul].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_zuul]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/cfssl/signers/mlserve/ca/mlserve-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve/ca/mlserve-key.pem].orig
+++ File[/etc/cfssl/signers/mlserve/ca/mlserve-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/mlserve/ca/mlserve-key.pem.orig
+++ /etc/cfssl/signers/mlserve/ca/mlserve-key.pem
@@ -1 +0,0 @@
-nosecret

Systemd::Service[cfssl-ocspserve@mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@mlserve_staging_front_proxy].orig
+++ Systemd::Service[cfssl-ocspserve@mlserve_staging_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Systemd::Unit[cfssl-ocsprefresh-wikikube.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-wikikube.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/apache2/conf-enabled/50-cfssl-issuer-k8s-pods-vhost-port.conf]

Parameters differences:

--- File[/etc/apache2/conf-enabled/50-cfssl-issuer-k8s-pods-vhost-port.conf].orig
+++ File[/etc/apache2/conf-enabled/50-cfssl-issuer-k8s-pods-vhost-port.conf]

-    target => /etc/apache2/conf-available/50-cfssl-issuer-k8s-pods-vhost-port.conf
-    ensure => link
-    owner  => root
-    group  => root
-    notify => Service[apache2]

File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-etcd-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-etcd-certificate-expiry --cert-path /etc/cfssl/signers/etcd/ca/etcd.pem --outfile /var/lib/prometheus/node.d/etcd_intermediate.prom

File[/etc/logrotate.d/wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- File[/etc/logrotate.d/wmf_auto_restart_apache-htcacheclean].orig
+++ File[/etc/logrotate.d/wmf_auto_restart_apache-htcacheclean]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => absent

Content differences:

--- /etc/logrotate.d/wmf_auto_restart_apache-htcacheclean.orig
+++ /etc/logrotate.d/wmf_auto_restart_apache-htcacheclean
@@ -1,12 +0,0 @@
-# logrotate(8) config for wmf_auto_restart_apache-htcacheclean
-
-/var/log/wmf_auto_restart_apache-htcacheclean/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@wikikube_front_proxy]']
-    command     => /bin/systemctl daemon-reload

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_kafka]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_kafka].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_kafka]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_kafka.service

Systemd::Timer::Job[cfssl-ocsprefresh-wikikube]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-wikikube].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-wikikube]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - wikikube
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube/ca/wikikube.pem --responses-file /etc/cfssl/ocsp/wikikube.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube' wikikube

Service[apache2]

Parameters differences:

--- Service[apache2].orig
+++ Service[apache2]

-    hasrestart => True
-    require    => Package[apache2]
-    restart    => systemctl reload apache2
-    enable     => True
-    ensure     => running
-    before     => ['Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]']

Logrotate::Conf[cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-dse_front_proxy].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-dse_front_proxy]

-    ensure => present

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_cloud_wmnet_ca
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem

Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy]

-    check_command  => nrpe_check!check_check_certificate_expiry_wikikube_staging_front_proxy!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging-front-proxy.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-wikikube_staging_front_proxy" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/srv/cfssl/bundles/wikikube_staging_front_proxy.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/wikikube_staging_front_proxy.pem].orig
+++ File[/srv/cfssl/bundles/wikikube_staging_front_proxy.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/wikikube_staging_front_proxy.pem.orig
+++ /srv/cfssl/bundles/wikikube_staging_front_proxy.pem
@@ -1,23 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDwDCCAyGgAwIBAgIUJT4TJHFy4qcc2DDVjG00p9VDOcIwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
-ijELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczElMCMGA1UEAwwcd2lraWt1YmVfc3RhZ2luZ19mcm9udF9wcm94eTCBmzAQ
-BgcqhkjOPQIBBgUrgQQAIwOBhgAEAQkWDUaTmBFtrLcFLkOP5LV+kGQdr0TIYAMX
-FR7UbUmysish4+UlH7C2vcugX/XmmIoh2asGRkfb0kjTQUUjqDmmANYQARMmx/V4
-j87yMi11K3IxBh2Ei7KJzvXD5yhg/rQa1TVcdvZ1GHBL1QvBU5x2L95G+Exi1amQ
-dC4vktygtdo8o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB
-Af8CAQEwHQYDVR0OBBYEFANI4okfmz36Vpe1jEq4tkgKl5HzMB8GA1UdIwQYMBaA
-FDutonHmNL0b/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcw
-AYY6aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50
-ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2Nv
-dmVyeS53bW5ldC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZI
-zj0EAwQDgYwAMIGIAkIBuKBFQ/g6puAs+HK7+bE4eiatpN7eotPUTNbVuxN4+rEO
-E6JEpXslb/Ad0rVDvEOmXGSH9EdqjCNJs0Qv5kFnqZQCQgCPyFWGoBUxDcWLjOEL
-2a1pt4joI2BUut3NtLOBgPeaI/5qqPoLFbxn/1DMBmZLlsoNhnrg99F5LgvQVEAA
-/3y5tw==
------END CERTIFICATE-----

Exec[Generate initial CRL for debmonitor]

Parameters differences:

--- Exec[Generate initial CRL for debmonitor].orig
+++ Exec[Generate initial CRL for debmonitor]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/debmonitor
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/debmonitor/ca/debmonitor.pem /etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/debmonitor

File[/srv/cfssl/bundles/mlserve_front_proxy.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/mlserve_front_proxy.pem].orig
+++ File[/srv/cfssl/bundles/mlserve_front_proxy.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/mlserve_front_proxy.pem.orig
+++ /srv/cfssl/bundles/mlserve_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDtzCCAxigAwIBAgIUIw4+rszPiPmnvGoMBfrD29oWNKcwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
-gTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczEcMBoGA1UEAwwTbWxzZXJ2ZV9mcm9udF9wcm94eTCBmzAQBgcqhkjOPQIB
-BgUrgQQAIwOBhgAEATdxtFPSx+kYYz4a6PyKfBi000SHiFxHSQqS71Bs13jbumD2
-h6uPdTyD3dT79AdxQVzoer7inVQZM1vz5ZioLN0mAVH9OdSm8NLPpy9CAjT/2puk
-6PZWtowGmcoOkXeZeZDIUOYam0f4udjmot9TDQPF07pSqABlhz1ejSC3AKOJDym+
-o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYD
-VR0OBBYEFDoU1EzaIZxR2ktTe35M8ILp07mdMB8GA1UdIwQYMBaAFDutonHmNL0b
-/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDov
-L3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
-dF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5l
-dC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwA
-MIGIAkIBsRpAWU0SxP3lwtUrriS8Dtal1vh2vfBMUzvx8hzjHGSYCg3xlG2cfnXN
-lFIhsQaWUmiJFZg8m+rCdYNkUMsdpeACQgCCHUls+Tf5Kcc756qs2iC2JSf2yd2U
-EM7VAJqZRVG9HrCUnzDLJT7bIQswE6i/O1zNhKjYV9xgd6LW+XCF0cVB7A==
------END CERTIFICATE-----

Firewall::Service[multirootca tls termination]

Parameters differences:

--- Firewall::Service[multirootca tls termination].orig
+++ Firewall::Service[multirootca tls termination]

-    desc                => 
-    prio                => 10
-    unrestricted_access => False
-    src_sets            => ['DOMAIN_NETWORKS']
-    proto               => tcp
-    port                => 443
-    ensure              => present
-    notrack             => False

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery2026.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery2026.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_discovery2026.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-discovery-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-discovery-certificate-expiry --cert-path /etc/cfssl/signers/discovery/ca/discovery.pem --outfile /var/lib/prometheus/node.d/discovery_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

File[/etc/cfssl/signers/cassandra/ca]

Parameters differences:

--- File[/etc/cfssl/signers/cassandra/ca].orig
+++ File[/etc/cfssl/signers/cassandra/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Prometheus::Node_textfile[prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-discovery2026-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-discovery2026-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-discovery2026-certificate-expiry --cert-path /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --outfile /var/lib/prometheus/node.d/discovery2026_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery2026 -profile ocsp /etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet

Sudo::User[nrpe-check_check_certificate_expiry_mlserve]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_mlserve].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_mlserve]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem']
-    user       => nagios

Sudo::User[nrpe-check_check_certificate_expiry_dse]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_dse].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_dse]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem']
-    user       => nagios

File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/cfssl/ocsp/etcd.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/etcd.ocsp].orig
+++ File[/etc/cfssl/ocsp/etcd.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Prometheus::Node_textfile[prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-dse-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-dse-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-dse-certificate-expiry --cert-path /etc/cfssl/signers/dse/ca/dse.pem --outfile /var/lib/prometheus/node.d/dse_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Systemd::Syslog[cfssl-ocsprefresh-wikikube]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-wikikube].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-wikikube]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-network_devices-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-network_devices-certificate-expiry --cert-path /etc/cfssl/signers/network_devices/ca/network_devices.pem --outfile /var/lib/prometheus/node.d/network_devices_intermediate.prom

Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-debmonitor.timer]']

File[/etc/cfssl/signers/wikikube_staging/ca]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging/ca].orig
+++ File[/etc/cfssl/signers/wikikube_staging/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/lib/systemd/system/cfssl-ocsprefresh-aux.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-aux.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-aux.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.service (cfssl-ocsprefresh-aux.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-aux.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-aux.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - aux
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/aux/ca/aux.pem --responses-file /etc/cfssl/ocsp/aux.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@aux' aux

Exec[renew certificate - OCSP_network_devices_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_network_devices_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_network_devices_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label network_devices -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet

File[/etc/apache2/sites-available/00-dummy.conf]

Parameters differences:

--- File[/etc/apache2/sites-available/00-dummy.conf].orig
+++ File[/etc/apache2/sites-available/00-dummy.conf]

-    mode   => 0444
-    source => puppet:///modules/httpd/dummy.conf
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[apache2]

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Systemd::Unit[cfssl-ocspserve@wikikube]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@wikikube].orig
+++ Systemd::Unit[cfssl-ocspserve@wikikube]

-    override          => False
-    unit              => cfssl-ocspserve@wikikube
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Monitoring::Service[check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_mlserve_front_proxy].orig
+++ Monitoring::Service[check_certificate_expiry_mlserve_front_proxy]

-    check_command  => nrpe_check!check_check_certificate_expiry_mlserve_front_proxy!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: mlserve_front_proxy
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_syslog]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_syslog].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_syslog]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_syslog.service

Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-mlserve_staging.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Systemd::Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Httpd::Mod_conf[ssl]

Parameters differences:

--- Httpd::Mod_conf[ssl].orig
+++ Httpd::Mod_conf[ssl]

-    loadfile => ssl.load
-    mod      => ssl
-    ensure   => present

Systemd::Unit[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@Wikimedia_Internal_Root_CA].orig
+++ Systemd::Unit[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

-    override          => False
-    unit              => cfssl-ocspserve@Wikimedia_Internal_Root_CA
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_puppet_rsa].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_puppet_rsa]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_puppet_rsa!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: puppet_rsa
-    check_interval         => 1

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Cfssl::Ocsp[discovery]

Parameters differences:

--- Cfssl::Ocsp[discovery].orig
+++ Cfssl::Ocsp[discovery]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 10002
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/discovery/ca/discovery.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-zuul-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-zuul-certificate-expiry --cert-path /etc/cfssl/signers/zuul/ca/zuul.pem --outfile /var/lib/prometheus/node.d/zuul_intermediate.prom

Sudo::User[nrpe_certificate_check_debmonitor]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_debmonitor].orig
+++ Sudo::User[nrpe_certificate_check_debmonitor]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_debmonitor

Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Service[cfssl-ocsprefresh-mlserve.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-mlserve.timer].orig
+++ Service[cfssl-ocsprefresh-mlserve.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Httpd::Mod_conf[proxy_http]

Parameters differences:

--- Httpd::Mod_conf[proxy_http].orig
+++ Httpd::Mod_conf[proxy_http]

-    loadfile => proxy_http.load
-    mod      => proxy_http
-    ensure   => present

File[/srv/cfssl/bundles/kafka.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/kafka.pem].orig
+++ File[/srv/cfssl/bundles/kafka.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/kafka.pem.orig
+++ /srv/cfssl/bundles/kafka.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqDCCAwmgAwIBAgIUTWT2navXkMW9fz3oUB7Fc6azbKcwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjExMDI4MTMwNjAwWhcNMjYxMDI3MTMwNjAwWjBz
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ4wDAYDVQQDEwVrYWZrYTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAScI
-AVY36upnobdfvpQJ7Y5uefRAv0OsdtR++HEqm2kTatOG4BJTdjdBv3+gyd3rJccd
-DEifyU1EcxVVXjjXzqdHADiJ+Zol5mwexbnrpF8JDBiJv7ntNamdr7Xjv4kw8Tkp
-kgl70aFalPLjpwjDNyrm2ACxPmHxK8EOu7eXb8RImqeVo4IBDDCCAQgwDgYDVR0P
-AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFGIY/nB0tTtl
-RGdO5J4ck+RM8p8rMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2MFYG
-CCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zlcnku
-d21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBB
-MD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1lZGlh
-X0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBv8ZMP7g8aPkc
-tcrO4rXcBkhFIWH9+4H4iTbuSBtjVtUXdsRW++IU89BjVVKQxv/4ZDm8hlpd+vJU
-b9xj3WUpi8cCQgFpjYqKVM+I5eRpIjhWoPxognJtGI3626wAOpV2CPauciD51gP3
-up2xe36OG3Z8XDcbNGoNiG3505+af9zBrt3c4g==
------END CERTIFICATE-----

Cfssl::Ocsp[etcd]

Parameters differences:

--- Cfssl::Ocsp[etcd].orig
+++ Cfssl::Ocsp[etcd]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 10005
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/etcd/ca/etcd.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

Exec[Generate initial CRL for aux_front_proxy]

Parameters differences:

--- Exec[Generate initial CRL for aux_front_proxy].orig
+++ Exec[Generate initial CRL for aux_front_proxy]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/aux_front_proxy
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/aux_front_proxy

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]']

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Prometheus::Node_textfile[prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-wikikube-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-wikikube-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-wikikube-certificate-expiry --cert-path /etc/cfssl/signers/wikikube/ca/wikikube.pem --outfile /var/lib/prometheus/node.d/wikikube_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/discovery2026/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/discovery2026/cfssl.conf].orig
+++ File[/etc/cfssl/signers/discovery2026/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/discovery2026/cfssl.conf.orig
+++ /etc/cfssl/signers/discovery2026/cfssl.conf
@@ -1,129 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/discovery2026",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/discovery2026"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_staging": {
-        "auth_key": "k8s_staging",
-        "expiry": "24h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_wikikube": {
-        "auth_key": "k8s_wikikube",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_mlserve": {
-        "auth_key": "k8s_mlserve",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_mlstaging": {
-        "auth_key": "k8s_mlstaging",
-        "expiry": "24h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_dse": {
-        "auth_key": "k8s_dse",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth",
-          "client auth"
-        ]
-      },
-      "k8s_dse_opensearch": {
-        "auth_key": "k8s_dse",
-        "expiry": "4380h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth",
-          "client auth"
-        ]
-      },
-      "k8s_aux": {
-        "auth_key": "k8s_aux",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Concat_fragment[main]

Content differences:

--- main.orig
+++ main
@@ -14,7 +14,6 @@
 [agent]
 use_srv_records = true
 srv_domain = eqiad.wmnet
-dns_alt_names = pki.discovery.wmnet
 daemonize = false
 http_connect_timeout = 60
 http_read_timeout = 960

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-kafka-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Systemd::Timer[cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-discovery2026].orig
+++ Systemd::Timer[cfssl-ocsprefresh-discovery2026]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-discovery2026.service

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_dse command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_dse
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "4384c5ebc49e03dbe331e279fac3f393" --timeout 10 --check-command "check_check_certificate_expiry_dse"

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-aux_front_proxy-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --outfile /var/lib/prometheus/node.d/aux_front_proxy_intermediate.prom

Systemd::Timer[cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ Systemd::Timer[cfssl-ocsprefresh-wikikube_front_proxy]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-wikikube_front_proxy.service

Sudo::User[nrpe-check_check_certificate_expiry_kafka]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_kafka].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_kafka]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem']
-    user       => nagios

Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Cfssl::Cert[OCSP_aux_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_aux_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_aux_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-aux]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => aux
-    notify          => Service[cfssl-ocspserve@aux]
-    profile         => ocsp

Prometheus::Node_textfile[prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-mlserve-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-mlserve-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-mlserve-certificate-expiry --cert-path /etc/cfssl/signers/mlserve/ca/mlserve.pem --outfile /var/lib/prometheus/node.d/mlserve_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Systemd::Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA].orig
+++ Systemd::Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Service[nrpe2nodexp-check_certificate_expiry_aux.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_aux.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_aux.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]']

Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.service (nrpe2nodexp-check_certificate_expiry_etcd.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_etcd.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_etcd command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_etcd
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "c834f873297e445663ead81279c0b928" --timeout 10 --check-command "check_check_certificate_expiry_etcd"

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-dse-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-dse-certificate-expiry --cert-path /etc/cfssl/signers/dse/ca/dse.pem --outfile /var/lib/prometheus/node.d/dse_intermediate.prom

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service

Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Package[python3-pymysql]

Parameters differences:

--- Package[python3-pymysql].orig
+++ Package[python3-pymysql]

-    provider => apt
-    ensure   => installed

File[/etc/logrotate.d/cfssl-ocsprefresh-zuul]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-zuul].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-zuul]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-zuul.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-zuul
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-zuul
-
-/var/log/cfssl-ocsprefresh-zuul/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[renew certificate - OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-mlserve_front_proxy.timer]']

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery2026]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery2026].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_discovery2026]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/etc/sudoers.d/nrpe_certificate_check_zuul]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_zuul].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_zuul]

-    owner  => root
-    group  => root
-    ensure => absent

File[/etc/cfssl/signers/cloud_wmnet_ca]

Parameters differences:

--- File[/etc/cfssl/signers/cloud_wmnet_ca].orig
+++ File[/etc/cfssl/signers/cloud_wmnet_ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    ensure => present

Monitoring::Service[check_certificate_expiry_cassandra]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_cassandra].orig
+++ Monitoring::Service[check_certificate_expiry_cassandra]

-    check_command  => nrpe_check!check_check_certificate_expiry_cassandra!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: cassandra
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-discovery2026-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-discovery2026-certificate-expiry --cert-path /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --outfile /var/lib/prometheus/node.d/discovery2026_intermediate.prom

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse_front_proxy].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse_front_proxy]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_dse_front_proxy!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: dse_front_proxy
-    check_interval         => 1

File[/etc/apache2/sites-enabled/00-dummy.conf]

Parameters differences:

--- File[/etc/apache2/sites-enabled/00-dummy.conf].orig
+++ File[/etc/apache2/sites-enabled/00-dummy.conf]

-    target => /etc/apache2/sites-available/00-dummy.conf
-    ensure => link
-    owner  => root
-    group  => root
-    notify => Service[apache2]

Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Systemd::Syslog[cfssl-ocsprefresh-etcd]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-etcd].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-etcd]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery2026]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery2026].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery2026]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_discovery2026 command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_discovery2026
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "bf2e3510cb63e5f05f545e816bab4edf" --timeout 10 --check-command "check_check_certificate_expiry_discovery2026"

File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca].orig
+++ File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Service[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_discovery2026.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]']

Monitoring::Service[check_certificate_expiry_network_devices]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_network_devices].orig
+++ Monitoring::Service[check_certificate_expiry_network_devices]

-    check_command  => nrpe_check!check_check_certificate_expiry_network_devices!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: network_devices
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[wmf_auto_restart_apache2.timer]']

File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem].orig
+++ File[/etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem.orig
+++ /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem
@@ -1 +0,0 @@
-test

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_syslog.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux_front_proxy].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_aux_front_proxy command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_aux_front_proxy
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "99cf4f8f014e8fd527800abcc213f494" --timeout 10 --check-command "check_check_certificate_expiry_aux_front_proxy"

Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-wikikube_staging]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Augeas[Apache2 logs]

Parameters differences:

--- Augeas[Apache2 logs].orig
+++ Augeas[Apache2 logs]

-    incl    => /etc/logrotate.d/apache2
-    require => Package[apache2]
-    lens    => Logrotate.lns
-    changes => ['set rule/schedule daily', 'set rule/rotate 30']

Systemd::Timer::Job[cfssl-ocsprefresh-network_devices]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-network_devices].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-network_devices]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - network_devices
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/network_devices/ca/network_devices.pem --responses-file /etc/cfssl/ocsp/network_devices.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@network_devices' network_devices

File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cloud_wmnet_ca.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cloud_wmnet_ca.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cloud_wmnet_ca.prom]

-    owner  => root
-    group  => root
-    ensure => absent

File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem].orig
+++ File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem.orig
+++ /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUHWrqd3I2VME7z6A5M3brKa5UlOgwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9tbHNlcnZlX3N0YWdpbmcwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABAAu0g2dBBEAH2iUfZLPv+mA+1srb6S3bdVyH/kRk+QZDoOMnM0H8Edn
-V+dakFKXnwl+w+qsOsWj1NP2FlOm3bTglwCIxFAzX5XaDfqWa74L1tIqDH6kx+bX
-yxnuGWT/U1cv8rIHFap7ccH3h5YxPQfHy73KRTWxPln6ByswgxekotwnCKOCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBSRzdapYuh57Gp5MstVlUJNJ+6zTzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-AY8VuLFo6MpcfxrDG8Junk8mESfQTMRbfeZM6WpHqKYBTESkpeV8HIdTYliFDAMX
-JqE94+xbPVaTS8DZ0xiXz4SjAkIBEIIXA4nOdLYbX/MvdKWr7aDunH8n1oO3K/op
-7NktfJd5CXuECxdSonHOb7PFW5lbpCtZrLxFzhB2Hlp1TBWHX84=
------END CERTIFICATE-----

File[/etc/cfssl/signers/syslog]

Parameters differences:

--- File[/etc/cfssl/signers/syslog].orig
+++ File[/etc/cfssl/signers/syslog]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Rsyslog::Conf[cfssl-ocsprefresh-mlserve]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-mlserve].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-mlserve]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-mlserve]
-    ensure   => present
-    priority => 40

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]']

Class[Profile::Apt]

Parameters differences:

--- Class[Profile::Apt].orig
+++ Class[Profile::Apt]

@@
-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[quickstack]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[atop]', 'Package[libpython2.7]', 'Package[libpython2.7-dev]', 'Package[libpython2.7-minimal]', 'Package[python2.7]', 'Package[libpython2.7-stdlib]', 'Package[python2.7-dev]', 'Package[python2.7-minimal]', 'Package[python2.7-dbg]', 'Package[python2.7-doc]', 'Package[python2.7-examples]', 'Package[libpython2.7-testsuite]', 'Package[intel-microcode]', 'Package[rasdaemon]', 'Package[libsnmp30]', 'Package[libdns-export1104]', 'Package[libdns1104]', 'Package[libisc-export1100]', 'Package[libisc1100]', 'Package[multiarch-support]', 'Package[libjson-c3]', 'Package[libpython3.7]', 'Package[libpython3.7-minimal]', 'Package[libpython3.7-stdlib]', 'Package[python3.7]', 'Package[python3.7-minimal]', 'Package[libevent-2.1-6]', 'Package[libwireshark11]', 'Package[libwiretap8]', 'Package[libwsutil9]', 'Package[libwscodecs2]', 'Package[libperl5.28]', 'Package[libmpdec2]', 'Package[perl-modules-5.28]', 'Package[libhogweed4]', 'Package[libnettle6]', 'Package[libprocps7]', 'Package[libip6tc0]', 'Package[libip4tc0]', 'Package[libiptc0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[apache2]', 'Package[links]', 'Package[ruby-sys-filesystem]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[python3-pymysql]', 'Package[python3-cryptography]']
+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[quickstack]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[atop]', 'Package[libpython2.7]', 'Package[libpython2.7-dev]', 'Package[libpython2.7-minimal]', 'Package[python2.7]', 'Package[libpython2.7-stdlib]', 'Package[python2.7-dev]', 'Package[python2.7-minimal]', 'Package[python2.7-dbg]', 'Package[python2.7-doc]', 'Package[python2.7-examples]', 'Package[libpython2.7-testsuite]', 'Package[intel-microcode]', 'Package[rasdaemon]', 'Package[libsnmp30]', 'Package[libdns-export1104]', 'Package[libdns1104]', 'Package[libisc-export1100]', 'Package[libisc1100]', 'Package[multiarch-support]', 'Package[libjson-c3]', 'Package[libpython3.7]', 'Package[libpython3.7-minimal]', 'Package[libpython3.7-stdlib]', 'Package[python3.7]', 'Package[python3.7-minimal]', 'Package[libevent-2.1-6]', 'Package[libwireshark11]', 'Package[libwiretap8]', 'Package[libwsutil9]', 'Package[libwscodecs2]', 'Package[libperl5.28]', 'Package[libmpdec2]', 'Package[perl-modules-5.28]', 'Package[libhogweed4]', 'Package[libnettle6]', 'Package[libprocps7]', 'Package[libip6tc0]', 'Package[libip4tc0]', 'Package[libiptc0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[ruby-sys-filesystem]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']

Systemd::Timer[nrpe2nodexp-check_cfssl-multirootca_status]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_cfssl-multirootca_status].orig
+++ Systemd::Timer[nrpe2nodexp-check_cfssl-multirootca_status]

-    splay              => 300
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_cfssl-multirootca_status.service

File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem].orig
+++ File[/etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

File[/lib/systemd/system/cfssl-ocsprefresh-aux.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-aux.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-aux.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-aux.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-aux.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-aux.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-aux.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Profile::Pki::Multirootca::Monitoring[mlserve_staging_front_proxy]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[mlserve_staging_front_proxy].orig
+++ Profile::Pki::Multirootca::Monitoring[mlserve_staging_front_proxy]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
-    intermediate => mlserve_staging_front_proxy

Rsyslog::Conf[cfssl-ocsprefresh-network_devices]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-network_devices].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-network_devices]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-network_devices]
-    ensure   => present
-    priority => 40

Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Service[cfssl-gc-expired-certs]

Parameters differences:

--- Systemd::Service[cfssl-gc-expired-certs].orig
+++ Systemd::Service[cfssl-gc-expired-certs]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-gc-expired-certs.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem

Nrpe::Monitor_service[check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_dse_front_proxy].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_dse_front_proxy]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: dse_front_proxy
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

File[/lib/systemd/system/cfssl-ocspserve@etcd.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@etcd.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@etcd.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@etcd.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@etcd.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (etcd)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10005 \
-          -responses /etc/cfssl/ocsp/etcd.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    ensure => present

Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-cloud_wmnet_ca.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label network_devices -profile ocsp /etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet

Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-puppet_rsa]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - puppet_rsa
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --responses-file /etc/cfssl/ocsp/puppet_rsa.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@puppet_rsa' puppet_rsa

Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_bfd2f7c6497e1da6323bef48d24f9e8e]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_bfd2f7c6497e1da6323bef48d24f9e8e].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_bfd2f7c6497e1da6323bef48d24f9e8e]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_mlserve))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="bfd2f7c6497e1da6323bef48d24f9e8e",check_name="check_check_certificate_expiry_mlserve", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__mlserve
-    group              => nrpechecks
-    severity           => info

File[/etc/cfssl/signers/aux_front_proxy/ca]

Parameters differences:

--- File[/etc/cfssl/signers/aux_front_proxy/ca].orig
+++ File[/etc/cfssl/signers/aux_front_proxy/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Systemd::Service[nrpe2nodexp-check_certificate_expiry_network_devices]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_network_devices].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_network_devices]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/var/log/cfssl-gc-expired-certs]

Parameters differences:

--- File[/var/log/cfssl-gc-expired-certs].orig
+++ File[/var/log/cfssl-gc-expired-certs]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/cfssl-ocsprefresh-zuul.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-zuul.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-zuul.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-zuul.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-zuul.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-zuul.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-zuul.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Logrotate::Conf[cfssl-ocsprefresh-wikikube]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-wikikube].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-wikikube]

-    ensure => present

Exec[Generate initial CRL for wikikube_staging]

Parameters differences:

--- Exec[Generate initial CRL for wikikube_staging].orig
+++ Exec[Generate initial CRL for wikikube_staging]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/wikikube_staging
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/wikikube_staging

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-aux-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-aux-certificate-expiry --cert-path /etc/cfssl/signers/aux/ca/aux.pem --outfile /var/lib/prometheus/node.d/aux_intermediate.prom

File[/etc/sudoers.d/nrpe_certificate_check_discovery]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_discovery].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_discovery]

-    owner  => root
-    group  => root
-    ensure => absent

Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-kafka.timer]']

Class[Profile::Contacts]

Parameters differences:

--- Class[Profile::Contacts].orig
+++ Class[Profile::Contacts]

@@
-    cluster => pki
+    cluster => insetup

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Logrotate::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    ensure => present

File[/etc/cfssl/signers/network_devices/ca/network_devices.pem]

Parameters differences:

--- File[/etc/cfssl/signers/network_devices/ca/network_devices.pem].orig
+++ File[/etc/cfssl/signers/network_devices/ca/network_devices.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/network_devices/ca/network_devices.pem.orig
+++ /etc/cfssl/signers/network_devices/ca/network_devices.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUS2pUBD1erPOX2W9m08l4NjcjbVYwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNzE0MTAxODAwWhcNMjgwNzEyMTAxODAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9uZXR3b3JrX2RldmljZXMwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABABVWARjDjpjG7IlggP4BkOm5hanZXdtYYzUb1CsmHvpBA4W6s8CjzHp
-QlZoBzaMi6SSO5Q7v9rAuymjLctweVRy7gAkNU3jjQXZPjRKaW/ofZlUhDyhgyCS
-WNr9LBjYklAnMM3yz3J6EG9aHehHbV11lq24AQDrZ4bEtNzGHMQyU9ufZ6OCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBRmY7aPPiOyhsjgXpDtumx9X/wcGzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-ARWhtt4Mi0I8j+6LUC+ZJfTnhYkEWSXa6nhttbzNPLzHuBTnj42WE8a2oQW2Mv5w
-mzRdtJGsstcrgGwGt5FyLP6WAkIAxYlEt4MHqohD9adWY1IsnX4qWBYRw4tXrx0T
-tF1M2n2K7ww/zCL9HkBoWVe249y+ctpGqqgw0ROMnMN6Q2Zg8ic=
------END CERTIFICATE-----

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_cassandra.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Cfssl::Signer[network_devices]

Parameters differences:

--- Cfssl::Signer[network_devices].orig
+++ Cfssl::Signer[network_devices]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDsjCCAxOgAwIBAgIUS2pUBD1erPOX2W9m08l4NjcjbVYwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNzE0MTAxODAwWhcNMjgwNzEyMTAxODAwWjB9
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRgwFgYDVQQDDA9uZXR3b3JrX2RldmljZXMwgZswEAYHKoZIzj0CAQYFK4EE
ACMDgYYABABVWARjDjpjG7IlggP4BkOm5hanZXdtYYzUb1CsmHvpBA4W6s8CjzHp
QlZoBzaMi6SSO5Q7v9rAuymjLctweVRy7gAkNU3jjQXZPjRKaW/ofZlUhDyhgyCS
WNr9LBjYklAnMM3yz3J6EG9aHehHbV11lq24AQDrZ4bEtNzGHMQyU9ufZ6OCAQww
ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
BBRmY7aPPiOyhsjgXpDtumx9X/wcGzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
ARWhtt4Mi0I8j+6LUC+ZJfTnhYkEWSXa6nhttbzNPLzHuBTnj42WE8a2oQW2Mv5w
mzRdtJGsstcrgGwGt5FyLP6WAkIAxYlEt4MHqohD9adWY1IsnX4qWBYRw4tXrx0T
tF1M2n2K7ww/zCL9HkBoWVe249y+ctpGqqgw0ROMnMN6Q2Zg8ic=
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/network_devices
-    db_host          => localhost
-    default_usages   => ['digital signature', 'key encipherment', 'server auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => fake key

-    ca_file          => /etc/cfssl/signers/network_devices/ca/network_devices.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    ca_key_file      => /etc/cfssl/signers/network_devices/ca/network_devices-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 8760h
-    default_crl_url  => http://pki.discovery.wmnet/crl/network_devices
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Prometheus::Alert::Rule[check_check_certificate_expiry_zuul_373325faaa689f3e9b058d91d4eb6cdb]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_zuul_373325faaa689f3e9b058d91d4eb6cdb].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_zuul_373325faaa689f3e9b058d91d4eb6cdb]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_zuul))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: zuul
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: zuul
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="373325faaa689f3e9b058d91d4eb6cdb",check_name="check_check_certificate_expiry_zuul", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__zuul
-    group              => nrpechecks
-    severity           => info

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_aux!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: aux
-    check_interval         => 1

Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet

Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem']
-    user       => nagios

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca].orig
+++ Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca]

-    check_command  => nrpe_check!check_check_certificate_expiry_cloud_wmnet_ca!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@dse_front_proxy]']
-    command     => /bin/systemctl daemon-reload

Motd::Message[insetup::infrastructure_foundations_ferm]

Parameters differences:

--- Motd::Message[insetup::infrastructure_foundations_ferm].orig
+++ Motd::Message[insetup::infrastructure_foundations_ferm]

+    priority => 5
+    message  => pki1001 is a Host being setup by Infrastructure Foundations SREs with ferm (insetup::infrastructure_foundations_ferm)
+    ensure   => present

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_etcd.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_etcd.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_etcd.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - debmonitor
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --responses-file /etc/cfssl/ocsp/debmonitor.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@debmonitor' debmonitor

Prometheus::Node_textfile[prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-wikikube_staging-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery2026]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery2026].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery2026]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_discovery2026.service

Systemd::Unit[cfssl-ocsprefresh-debmonitor.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-debmonitor.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-debmonitor.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-debmonitor.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Service[cfssl-ocspserve@discovery2026]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@discovery2026].orig
+++ Systemd::Service[cfssl-ocspserve@discovery2026]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/usr/local/sbin/cfssl-ocsprefresh]

Parameters differences:

--- File[/usr/local/sbin/cfssl-ocsprefresh].orig
+++ File[/usr/local/sbin/cfssl-ocsprefresh]

-    mode   => 0550
-    source => puppet:///modules/cfssl/cfssl_ocsprefresh.py
-    ensure => file
-    owner  => root
-    group  => root

Service[cfssl-ocsprefresh-mlserve_front_proxy.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-mlserve_front_proxy.timer].orig
+++ Service[cfssl-ocsprefresh-mlserve_front_proxy.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf].orig
+++ File[/etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf.orig
+++ /etc/rsyslog.d/40-wmf-auto-restart-apache-htcacheclean.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "wmf_auto_restart_apache-htcacheclean" then {
-    action(
-        type="omfile" file="/var/log/wmf_auto_restart_apache-htcacheclean/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-aux_front_proxy.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Prometheus::Blackbox::Check::Http[PKI_wikikube_staging]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_wikikube_staging].orig
+++ Prometheus::Blackbox::Check::Http[PKI_wikikube_staging]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"wikikube_staging"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Systemd::Unit[cfssl-ocsprefresh-kafka.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-kafka.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-kafka.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-kafka.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Exec[Generate initial CRL for network_devices]

Parameters differences:

--- Exec[Generate initial CRL for network_devices].orig
+++ Exec[Generate initial CRL for network_devices]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/network_devices
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/network_devices/ca/network_devices.pem /etc/cfssl/signers/network_devices/ca/network_devices-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/network_devices

File[/etc/cfssl/signers/mlserve_staging_front_proxy]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging_front_proxy].orig
+++ File[/etc/cfssl/signers/mlserve_staging_front_proxy]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Systemd::Service[cfssl-ocspserve@zuul]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@zuul].orig
+++ Systemd::Service[cfssl-ocspserve@zuul]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_front_proxy command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "9d6dd05c8e5e1bb294462d932b24bd1a" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_front_proxy"

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service

Prometheus::Blackbox::Check::Http[PKI_etcd]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_etcd].orig
+++ Prometheus::Blackbox::Check::Http[PKI_etcd]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"etcd"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_cfssl-multirootca_status.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-mlserve_staging.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-mlserve_staging.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/sudoers.d/nrpe_certificate_check_dse_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_dse_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_dse_front_proxy]

-    owner  => root
-    group  => root
-    ensure => absent

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cassandra]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cassandra].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cassandra]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_cassandra command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_cassandra
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "f5e260f525c48c963fb2e6c86a0d5d63" --timeout 10 --check-command "check_check_certificate_expiry_cassandra"

File[/etc/cfssl/signers/dse/ca]

Parameters differences:

--- File[/etc/cfssl/signers/dse/ca].orig
+++ File[/etc/cfssl/signers/dse/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Systemd::Service[cfssl-ocspserve@aux_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@aux_front_proxy].orig
+++ Systemd::Service[cfssl-ocspserve@aux_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Logrotate::Conf[cfssl-ocsprefresh-cassandra]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-cassandra].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-cassandra]

-    ensure => present

Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.service (cfssl-ocsprefresh-cloud_wmnet_ca.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-wikikube_front_proxy-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_front_proxy_intermediate.prom

Systemd::Unit[cfssl-gc-expired-certs.service]

Parameters differences:

--- Systemd::Unit[cfssl-gc-expired-certs.service].orig
+++ Systemd::Unit[cfssl-gc-expired-certs.service]

-    override          => False
-    unit              => cfssl-gc-expired-certs.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Systemd::Timer[cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ Systemd::Timer[cfssl-ocsprefresh-cloud_wmnet_ca]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-cloud_wmnet_ca.service

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-cloud_wmnet_ca.timer (cfssl-ocsprefresh-cloud_wmnet_ca.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer]']

Systemd::Service[cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ Systemd::Service[cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Systemd::Timer[cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ Systemd::Timer[cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-mlserve_staging_front_proxy.service

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-network-devices-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/signers/wikikube_staging_front_proxy]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging_front_proxy].orig
+++ File[/etc/cfssl/signers/wikikube_staging_front_proxy]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Ferm::Service[csr_and_ocsp_responder]

Parameters differences:

--- Ferm::Service[csr_and_ocsp_responder].orig
+++ Ferm::Service[csr_and_ocsp_responder]

-    desc                => 
-    prio                => 10
-    unrestricted_access => False
-    src_sets            => ['DOMAIN_NETWORKS', 'MGMT_NETWORKS']
-    proto               => tcp
-    port                => 80
-    ensure              => present
-    notrack             => False

File[/lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@Wikimedia_Internal_Root_CA.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (Wikimedia_Internal_Root_CA)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10000 \
-          -responses /etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/signers/zuul/ca/zuul-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/zuul/ca/zuul-key.pem].orig
+++ File[/etc/cfssl/signers/zuul/ca/zuul-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/zuul/ca/zuul-key.pem.orig
+++ /etc/cfssl/signers/zuul/ca/zuul-key.pem
@@ -1 +0,0 @@
-nosecret

File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem]

Parameters differences:

--- File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem].orig
+++ File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem.orig
+++ /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
@@ -1,30 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIFNDCCBJagAwIBAgIUOR+ZAFtrzLKYphDIGMa9eF6O0LIwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjIwMTIwNTAwWhcNMjgwNjE4MTIwNTAwWjB4
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRMwEQYDVQQDDApwdXBwZXRfcnNhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
-MIICCgKCAgEA4urK5Og7RVGoXg6KzYywzaXyRROuj0Kauc7n/BgCWvsKv9Ll4f/p
-lbVGOSln3akzhBlJwmVTGrgCmWQVxMF2agKAR+R1aV2Wc+yEfofUbW1oRgBCelMQ
-Xutw0cApO+lzjHNtduffeIEVBjwLcEG/OdaUa2CGFGLG/dHox7o8AZgkH7SFJyby
-z/rzip+szHpMThhjs0PKx91VS1srb7Q1jE1OlB7ydhX+gLRWTjwxOp1ITFXjNobk
-i16jcP3YYgCvj8qwWMcYmtI7iExSeFdptv3fmajBeoi1o52LUWKUrslwtNa/emaB
-FBGRZfu8ap+BWWpYYarI4mOCyvetw/6FZ2LnuWy5cNA3GoALB5xfLpO3twYnrveP
-BnxULp4Q8szITB/bjPBMkd8FG8Frpe3eZNKNHG9xjJGdS1Bxhq7Zgfy09V1RJCym
-AJSWERHRrxjEnRCDd7HUAhfaDCygeooe4wGRR5bG8WqOpkQDtYPP3yfk5NBhcJpW
-mXTRFTFkuslEL/2bwa9EPIOAKAINDeJOCHqJMQd6EXwTP2LabWU3oI+sfeBdCoSd
-Rn+q2Z0kSLu8fqXsgPgvdgyWjfPkQnyLAz9rdsal2x4x9SilDkov+l6Q9DXGGoYO
-GGOHHFCFhM9CS02zFGLe1JbqiHPuYuIkEnGjGJyCqdIB8Rz0JxdypEcCAwEAAaOC
-AQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1Ud
-DgQWBBRrq/ZHBKl8OZGQrQCiUq4GRc86YDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yA
-vzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9w
-a2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3Rf
-Q0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQv
-Y3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCB
-hwJBJHrjuBvyK8Sv40xCW/TrVtOCIVaXfjwsKau9lkmt/6purO/xkppZDMajueYw
-9koKhj6SvliOpiwgypfOKP7nbsACQgFAnawARDYCoOQ8pQDoqpRkPBBScMOTMPFu
-xTekxW2V7POn9dn6uavLJz/wha+sNgAnYT4wHWkRJzbUk+1H3Hb3NA==
------END CERTIFICATE-----

Sudo::User[nrpe-check_check_certificate_expiry_etcd]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_etcd].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_etcd]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem']
-    user       => nagios

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_aux.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/signers/etcd/ca/etcd.pem]

Parameters differences:

--- File[/etc/cfssl/signers/etcd/ca/etcd.pem].orig
+++ File[/etc/cfssl/signers/etcd/ca/etcd.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/etcd/ca/etcd.pem.orig
+++ /etc/cfssl/signers/etcd/ca/etcd.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpzCCAwigAwIBAgIUOk3cFWirYBfYaO6q8zyqfEHxwVEwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIwODEwMTAzODAwWhcNMjcwODA5MTAzODAwWjBy
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ0wCwYDVQQDEwRldGNkMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAgtdp
-7nZHIAQhEm2IlJ7AzfGjWIGGzKzCfnBQ8d+euPiOZ3ccv1YXfx0f+WmV35vuEmA/
-ZSw/6iJrKBnYsZAR6U0ByUUqg6nUYg4P47Sc/kMTWmVIgRuNhmrgavCK+qRQdnZs
-N/OOGTgFNG0icty63dUF4NZz80HxHSrPQYaNxZ9ydY2jggEMMIIBCDAOBgNVHQ8B
-Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUtvZYHyYnZHZP
-ZLIB5kqPcVOVI9owHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
-KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
-bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
-P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
-SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgEgYyeOREniK9JC
-4hvIiuv9D7mVVXzX5/s8GuhTbRadqZr41ulpHT53lFcbt+xhAsyqMxXPhgT/OyMQ
-jkXuEh5oBQJCAM22xLZpt2XwKCp0opgXlC5fm5+YjKba2COlr43q78I2la57aYdp
-UF7sFgBRFVx7FNY7CASuZMYsW+4wltPTXVau
------END CERTIFICATE-----

Exec[Generate initial CRL for syslog]

Parameters differences:

--- Exec[Generate initial CRL for syslog].orig
+++ Exec[Generate initial CRL for syslog]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/syslog
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/syslog/ca/syslog.pem /etc/cfssl/signers/syslog/ca/syslog-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/syslog

Logrotate::Conf[cfssl-gc-expired-certs]

Parameters differences:

--- Logrotate::Conf[cfssl-gc-expired-certs].orig
+++ Logrotate::Conf[cfssl-gc-expired-certs]

-    ensure => present

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_discovery.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_discovery.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-staging.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-wikikube_staging" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-wikikube_staging/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Exec[Generate initial CRL for kafka]

Parameters differences:

--- Exec[Generate initial CRL for kafka].orig
+++ Exec[Generate initial CRL for kafka]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/kafka
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/kafka/ca/kafka.pem /etc/cfssl/signers/kafka/ca/kafka-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/kafka

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Logrotate::Conf[cfssl-ocsprefresh-discovery]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-discovery].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-discovery]

-    ensure => present

File[/var/log/cfssl-ocsprefresh-zuul]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-zuul].orig
+++ File[/var/log/cfssl-ocsprefresh-zuul]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-network_devices.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-network_devices.service (cfssl-ocsprefresh-network_devices.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-network_devices.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-network_devices.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - network_devices
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/network_devices/ca/network_devices.pem --responses-file /etc/cfssl/ocsp/network_devices.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@network_devices' network_devices

Systemd::Syslog[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/lib/systemd/system/cfssl-ocsprefresh-kafka.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-kafka.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-kafka.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-kafka.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-kafka.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - kafka
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/kafka/ca/kafka.pem --responses-file /etc/cfssl/ocsp/kafka.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@kafka' kafka

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-discovery" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-discovery/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/kafka]

Parameters differences:

--- File[/etc/cfssl/signers/kafka].orig
+++ File[/etc/cfssl/signers/kafka]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/srv/cfssl/bundles/network_devices.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/network_devices.pem].orig
+++ File[/srv/cfssl/bundles/network_devices.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/network_devices.pem.orig
+++ /srv/cfssl/bundles/network_devices.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUS2pUBD1erPOX2W9m08l4NjcjbVYwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNzE0MTAxODAwWhcNMjgwNzEyMTAxODAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9uZXR3b3JrX2RldmljZXMwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABABVWARjDjpjG7IlggP4BkOm5hanZXdtYYzUb1CsmHvpBA4W6s8CjzHp
-QlZoBzaMi6SSO5Q7v9rAuymjLctweVRy7gAkNU3jjQXZPjRKaW/ofZlUhDyhgyCS
-WNr9LBjYklAnMM3yz3J6EG9aHehHbV11lq24AQDrZ4bEtNzGHMQyU9ufZ6OCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBRmY7aPPiOyhsjgXpDtumx9X/wcGzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-ARWhtt4Mi0I8j+6LUC+ZJfTnhYkEWSXa6nhttbzNPLzHuBTnj42WE8a2oQW2Mv5w
-mzRdtJGsstcrgGwGt5FyLP6WAkIAxYlEt4MHqohD9adWY1IsnX4qWBYRw4tXrx0T
-tF1M2n2K7ww/zCL9HkBoWVe249y+ctpGqqgw0ROMnMN6Q2Zg8ic=
------END CERTIFICATE-----

Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem].orig
+++ File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem.orig
+++ /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem
@@ -1 +0,0 @@
-nosecret

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_dse.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_dse.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@Wikimedia_Internal_Root_CA.service (cfssl-ocspserve@Wikimedia_Internal_Root_CA)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]']
-    command     => /bin/systemctl daemon-reload

Httpd::Conf[cfssl-issuer-k8s-pods-vhost-port]

Parameters differences:

--- Httpd::Conf[cfssl-issuer-k8s-pods-vhost-port].orig
+++ Httpd::Conf[cfssl-issuer-k8s-pods-vhost-port]

-    conf_type => conf
-    ensure    => present
-    priority  => 50

Cfssl::Ocsp[wikikube_staging_front_proxy]

Parameters differences:

--- Cfssl::Ocsp[wikikube_staging_front_proxy].orig
+++ Cfssl::Ocsp[wikikube_staging_front_proxy]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 20021
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-etcd.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-etcd" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-etcd/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/etc/logrotate.d/cfssl-gc-expired-certs]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-gc-expired-certs].orig
+++ File[/etc/logrotate.d/cfssl-gc-expired-certs]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-gc-expired-certs.orig
+++ /etc/logrotate.d/cfssl-gc-expired-certs
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-gc-expired-certs
-
-/var/log/cfssl-gc-expired-certs/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[cfssl-ocsprefresh-discovery2026.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-discovery2026.timer].orig
+++ Service[cfssl-ocsprefresh-discovery2026.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-dse.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-dse" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-dse/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/srv/cfssl/bundles/syslog.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/syslog.pem].orig
+++ File[/srv/cfssl/bundles/syslog.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/syslog.pem.orig
+++ /srv/cfssl/bundles/syslog.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqTCCAwqgAwIBAgIUI5/ixOCtnw8ZXV6xWw6RVC/D6rwwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwOTI4MTAzNzAwWhcNMjgwOTI2MTAzNzAwWjB0
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ8wDQYDVQQDEwZzeXNsb2cwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABL
-CaZwsDnVcBhApShaeA1j8/9w4S2re0Zmjx7GTeBXiJcKF0dAhgAQRCMrGtWEimmQ
-W94s5015H1MknO61lLOY+wDAFYkq98rZF2aRRILm1w/5iRkqTDiBECBVE15jrPzD
-q4zZCQ5V5ellWhzfGfPMxFOogIm1sqZsqZvB7zZaCSOrbaOCAQwwggEIMA4GA1Ud
-DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRvwMc33QVQ
-qaT1dZmUUtkBeYiyzjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBW
-BggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5
-LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMw
-QTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRp
-YV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAUtK7APyQamN
-8DYOBCd1wJQ1DbYlzcQOcupJns2RKKcxFp1evo2GQjDA15TN1OXtA+pvK/liCAEh
-p828+NcE6fPMAkIBN/Yjhvy0lrtVzshqckUEciShFhbDU0QZOHuzIXCVjdskzQfu
-as4ZMO15kIv0MZUJ6V9aKEE6nqzi9QXifjuoY54=
------END CERTIFICATE-----

Prometheus::Blackbox::Check::Http[PKI_dse]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_dse].orig
+++ Prometheus::Blackbox::Check::Http[PKI_dse]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"dse"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-wikikube_staging.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Service[cfssl-ocspserve@mlserve]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@mlserve].orig
+++ Systemd::Service[cfssl-ocspserve@mlserve]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cloud_wmnet_ca].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_cloud_wmnet_ca]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_cloud_wmnet_ca!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
-    check_interval         => 1

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-wikikube-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-wikikube-certificate-expiry --cert-path /etc/cfssl/signers/wikikube/ca/wikikube.pem --outfile /var/lib/prometheus/node.d/wikikube_intermediate.prom

File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr].orig
+++ File[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr.orig
+++ /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr
@@ -1,14 +0,0 @@
-{
-  "CN": "pki.discovery.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet",
-    "pki.discovery.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/etc/cfssl/ocsp/aux_front_proxy.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/aux_front_proxy.ocsp].orig
+++ File[/etc/cfssl/ocsp/aux_front_proxy.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Systemd::Service[cfssl-ocspserve@mlserve_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@mlserve_front_proxy].orig
+++ Systemd::Service[cfssl-ocspserve@mlserve_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-mlserve_staging-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_intermediate.prom

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]
-    ensure   => present
-    priority => 40

Logrotate::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    ensure => present

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]
-    ensure   => present
-    priority => 40

File[/srv/cfssl/bundles/dse_front_proxy.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/dse_front_proxy.pem].orig
+++ File[/srv/cfssl/bundles/dse_front_proxy.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/dse_front_proxy.pem.orig
+++ /srv/cfssl/bundles/dse_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUBGeKXglKnoXGyRgWodaHSfz0z/gwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9kc2VfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABAGUNx07sN1MWk3DzjEFh3pfYaQVrqo1tWFQjf7URfwqfyZY81Tqt6yl
-y/zj3DpvtOmvyI5jPH91yPBaFho0/SpP6wFkBIyE8/Ik2b80slPKuzstrYgBlYsG
-+Fxop4CYWjLItOy1Ut82aYr76hNm0goEma9ETjgE4nfBEU3vi77QO/B9E6OCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBQPHxMmkuy8EqO+Wz7TmM1MfmcXDDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-AO3JNb9OyC3JQ3mmkgt+Db3NMgLArYlvcYd8Nd5uWEXm6d6NfUPDN5XBGkjly1B7
-N18vKQYxlZzX2wgYqaK9LYs9AkIBch3vTND/M2T78Hhp5YoodasCdLDcpMJ1Qn3T
-fI0Lwjt7W50T0FMle6CwZkI+ZrxRzqvic19IUSTDDqwiOFgLhqM=
------END CERTIFICATE-----

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-aux-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-aux-certificate-expiry --cert-path /etc/cfssl/signers/aux/ca/aux.pem --outfile /var/lib/prometheus/node.d/aux_intermediate.prom

File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem].orig
+++ File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem.orig
+++ /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDtzCCAxigAwIBAgIUIw4+rszPiPmnvGoMBfrD29oWNKcwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
-gTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczEcMBoGA1UEAwwTbWxzZXJ2ZV9mcm9udF9wcm94eTCBmzAQBgcqhkjOPQIB
-BgUrgQQAIwOBhgAEATdxtFPSx+kYYz4a6PyKfBi000SHiFxHSQqS71Bs13jbumD2
-h6uPdTyD3dT79AdxQVzoer7inVQZM1vz5ZioLN0mAVH9OdSm8NLPpy9CAjT/2puk
-6PZWtowGmcoOkXeZeZDIUOYam0f4udjmot9TDQPF07pSqABlhz1ejSC3AKOJDym+
-o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYD
-VR0OBBYEFDoU1EzaIZxR2ktTe35M8ILp07mdMB8GA1UdIwQYMBaAFDutonHmNL0b
-/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDov
-L3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
-dF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5l
-dC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwA
-MIGIAkIBsRpAWU0SxP3lwtUrriS8Dtal1vh2vfBMUzvx8hzjHGSYCg3xlG2cfnXN
-lFIhsQaWUmiJFZg8m+rCdYNkUMsdpeACQgCCHUls+Tf5Kcc756qs2iC2JSf2yd2U
-EM7VAJqZRVG9HrCUnzDLJT7bIQswE6i/O1zNhKjYV9xgd6LW+XCF0cVB7A==
------END CERTIFICATE-----

Systemd::Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Systemd::Syslog[wmf_auto_restart_apache2]

Parameters differences:

--- Systemd::Syslog[wmf_auto_restart_apache2].orig
+++ Systemd::Syslog[wmf_auto_restart_apache2]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Systemd::Service[cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ Systemd::Service[cfssl-ocsprefresh-mlserve_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-mlserve_front_proxy.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/cfssl/signers/aux_front_proxy]

Parameters differences:

--- File[/etc/cfssl/signers/aux_front_proxy].orig
+++ File[/etc/cfssl/signers/aux_front_proxy]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging -profile ocsp /etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet

File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Systemd::Unit[cfssl-ocspserve@wikikube_staging]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@wikikube_staging].orig
+++ Systemd::Unit[cfssl-ocspserve@wikikube_staging]

-    override          => False
-    unit              => cfssl-ocspserve@wikikube_staging
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_aux.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_aux.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Prometheus::Alert::Rule[check_check_certificate_expiry_debmonitor_224e2ac3574a9ce482218106d95a2931]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_debmonitor_224e2ac3574a9ce482218106d95a2931].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_debmonitor_224e2ac3574a9ce482218106d95a2931]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_debmonitor))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: debmonitor
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: debmonitor
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="224e2ac3574a9ce482218106d95a2931",check_name="check_check_certificate_expiry_debmonitor", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__debmonitor
-    group              => nrpechecks
-    severity           => info

File[/etc/apache2/conf-available/00-defaults.conf]

Parameters differences:

--- File[/etc/apache2/conf-available/00-defaults.conf].orig
+++ File[/etc/apache2/conf-available/00-defaults.conf]

-    mode   => 0444
-    source => puppet:///modules/httpd/defaults.conf
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[apache2]

Exec[apache2_test_config_and_restart]

Parameters differences:

--- Exec[apache2_test_config_and_restart].orig
+++ Exec[apache2_test_config_and_restart]

-    before      => Service[apache2]
-    onlyif      => /usr/sbin/apache2ctl configtest
-    refreshonly => True
-    command     => /usr/sbin/service apache2 restart

Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-aux.timer (cfssl-ocsprefresh-aux.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-aux.timer]']

File[/etc/cfssl/signers/kafka/ca/kafka-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/kafka/ca/kafka-key.pem].orig
+++ File[/etc/cfssl/signers/kafka/ca/kafka-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Logrotate::Conf[wmf_auto_restart_apache2]

Parameters differences:

--- Logrotate::Conf[wmf_auto_restart_apache2].orig
+++ Logrotate::Conf[wmf_auto_restart_apache2]

-    ensure => present

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_aux.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Prometheus::Node_textfile[prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-zuul-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-zuul-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-zuul-certificate-expiry --cert-path /etc/cfssl/signers/zuul/ca/zuul.pem --outfile /var/lib/prometheus/node.d/zuul_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Systemd::Unit[cfssl-ocspserve@mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@mlserve_staging_front_proxy].orig
+++ Systemd::Unit[cfssl-ocspserve@mlserve_staging_front_proxy]

-    override          => False
-    unit              => cfssl-ocspserve@mlserve_staging_front_proxy
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-network_devices-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-network_devices-certificate-expiry --cert-path /etc/cfssl/signers/network_devices/ca/network_devices.pem --outfile /var/lib/prometheus/node.d/network_devices_intermediate.prom

Sudo::User[nrpe_certificate_check_aux_front_proxy]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_aux_front_proxy].orig
+++ Sudo::User[nrpe_certificate_check_aux_front_proxy]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_aux_front_proxy

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_cloud_wmnet_ca command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "f87f54115f2f782169eed72541c30a1e" --timeout 10 --check-command "check_check_certificate_expiry_cloud_wmnet_ca"

File[/lib/systemd/system/cfssl-ocspserve@cassandra.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@cassandra.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@cassandra.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@cassandra.service (cfssl-ocspserve@cassandra)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@cassandra.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@cassandra.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (cassandra)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10006 \
-          -responses /etc/cfssl/ocsp/cassandra.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Cfssl::Config[mlserve]

Parameters differences:

--- Cfssl::Config[mlserve].orig
+++ Cfssl::Config[mlserve]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/mlserve
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/mlserve/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/mlserve

Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_syslog.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_syslog.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_syslog.prom]

-    owner  => root
-    group  => root
-    ensure => absent

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-front-proxy-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Cfssl::Cert[OCSP_discovery_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_discovery_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_discovery_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-discovery]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => discovery
-    notify          => Service[cfssl-ocspserve@discovery]
-    profile         => ocsp

File[/lib/systemd/system/cfssl-ocsprefresh-etcd.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-etcd.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-etcd.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-etcd.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-etcd.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - etcd
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/etcd/ca/etcd.pem --responses-file /etc/cfssl/ocsp/etcd.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@etcd' etcd

File[/var/log/cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-mlserve_staging].orig
+++ File[/var/log/cfssl-ocsprefresh-mlserve_staging]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Firewall::Service[multirootca-tls-termination-for-cfssl-issuer-k8s-pods]

Parameters differences:

--- Firewall::Service[multirootca-tls-termination-for-cfssl-issuer-k8s-pods].orig
+++ Firewall::Service[multirootca-tls-termination-for-cfssl-issuer-k8s-pods]

-    desc                => 
-    prio                => 10
-    unrestricted_access => False
-    src_sets            => ['WIKIKUBE_KUBEPODS_NETWORKS', 'STAGING_KUBEPODS_NETWORKS', 'MLSERVE_KUBEPODS_NETWORKS', 'MLSTAGE_KUBEPODS_NETWORKS', 'DSE_KUBEPODS_NETWORKS', 'AUX_KUBEPODS_NETWORKS']
-    proto               => tcp
-    ensure              => present
-    port                => 8443
-    notrack             => False

Cfssl::Ocsp[aux_front_proxy]

Parameters differences:

--- Cfssl::Ocsp[aux_front_proxy].orig
+++ Cfssl::Ocsp[aux_front_proxy]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 20051
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-wikikube_staging.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-wikikube_staging.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Prometheus::Blackbox::Check::Http[PKI_aux]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_aux].orig
+++ Prometheus::Blackbox::Check::Http[PKI_aux]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"aux"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-aux-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-aux-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Nrpe::Monitor_service[check_certificate_expiry_wikikube]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_wikikube].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_wikikube]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: wikikube
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

Monitoring::Service[check_certificate_expiry_mlserve]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_mlserve].orig
+++ Monitoring::Service[check_certificate_expiry_mlserve]

-    check_command  => nrpe_check!check_check_certificate_expiry_mlserve!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: mlserve
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Cfssl::Cert[OCSP_etcd_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_etcd_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_etcd_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-etcd]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => etcd
-    notify          => Service[cfssl-ocspserve@etcd]
-    profile         => ocsp

File[/lib/systemd/system/wmf_auto_restart_apache2.service]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_apache2.service].orig
+++ File[/lib/systemd/system/wmf_auto_restart_apache2.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)]

Content differences:

--- /lib/systemd/system/wmf_auto_restart_apache2.service.orig
+++ /lib/systemd/system/wmf_auto_restart_apache2.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Auto restart job: apache2
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/wmf-auto-restart -s apache2

Systemd::Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Rsyslog::Conf[cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-debmonitor].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-debmonitor]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-debmonitor]
-    ensure   => present
-    priority => 40

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery2026.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_discovery2026]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-dse_front_proxy-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --outfile /var/lib/prometheus/node.d/dse_front_proxy_intermediate.prom

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Sudo::User[nrpe_certificate_check_etcd]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_etcd].orig
+++ Sudo::User[nrpe_certificate_check_etcd]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_etcd

File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-cassandra.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-cassandra.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - cassandra
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/cassandra/ca/cassandra.pem --responses-file /etc/cfssl/ocsp/cassandra.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@cassandra' cassandra

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-mlserve_staging_front_proxy-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_front_proxy_intermediate.prom

Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - mlserve_staging_front_proxy
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --responses-file /etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_staging_front_proxy' mlserve_staging_front_proxy

Cfssl::Config[mlserve_front_proxy]

Parameters differences:

--- Cfssl::Config[mlserve_front_proxy].orig
+++ Cfssl::Config[mlserve_front_proxy]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/mlserve_front_proxy
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/mlserve_front_proxy/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/mlserve_front_proxy

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_wikikube.service

Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy]
-    ensure   => present
-    priority => 40

Ferm::Service[multirootca_tls_termination_for_cfssl_issuer_k8s_pods]

Parameters differences:

--- Ferm::Service[multirootca_tls_termination_for_cfssl_issuer_k8s_pods].orig
+++ Ferm::Service[multirootca_tls_termination_for_cfssl_issuer_k8s_pods]

-    desc                => 
-    prio                => 10
-    unrestricted_access => False
-    src_sets            => ['WIKIKUBE_KUBEPODS_NETWORKS', 'STAGING_KUBEPODS_NETWORKS', 'MLSERVE_KUBEPODS_NETWORKS', 'MLSTAGE_KUBEPODS_NETWORKS', 'DSE_KUBEPODS_NETWORKS', 'AUX_KUBEPODS_NETWORKS']
-    proto               => tcp
-    ensure              => present
-    port                => 8443
-    notrack             => False

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_kafka.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_kafka]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem

Httpd::Conf[dummy]

Parameters differences:

--- Httpd::Conf[dummy].orig
+++ Httpd::Conf[dummy]

-    conf_type => sites
-    source    => puppet:///modules/httpd/dummy.conf
-    ensure    => present
-    priority  => 0

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Cfssl::Cert[OCSP_zuul_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_zuul_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_zuul_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-zuul]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => zuul
-    notify          => Service[cfssl-ocspserve@zuul]
-    profile         => ocsp

Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_dse.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Exec[Generate initial CRL for puppet_rsa]

Parameters differences:

--- Exec[Generate initial CRL for puppet_rsa].orig
+++ Exec[Generate initial CRL for puppet_rsa]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/puppet_rsa
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/puppet_rsa

File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem].orig
+++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]

-    mode   => 0440
-    source => puppet:///modules/profile/pki/intermediates/puppet_rsa-cert.pem
-    ensure => file
-    owner  => root
-    group  => root

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-zuul.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_zuul" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Cfssl::Signer[cloud_wmnet_ca]

Parameters differences:

--- Cfssl::Signer[cloud_wmnet_ca].orig
+++ Cfssl::Signer[cloud_wmnet_ca]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDrzCCAxKgAwIBAgIURAaLNJ85iLqv3Tqt4ylu7Dhe0o0wCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjExMjEzMTg1NTAwWhcNMjYxMjEyMTg1NTAwWjB8
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRcwFQYDVQQDDA5jbG91ZF93bW5ldF9jYTCBmzAQBgcqhkjOPQIBBgUrgQQA
IwOBhgAEAFsH4mfZKGu87WTpX9yabGE0+vO4UBQaN/IUGnjmscZTZ7761iAwuZcs
33yjwzoX2W+R0IwAPJbagtB92uYPmA6eAUDV4WAuOml+AqAP0elVtW7i+T/Bm4qc
SrlGCDsALgJ765YZCDS9OmzAm9rXbQXFmsxqrm9I3aPXIOWIww5+Zg1mo4IBDDCC
AQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
FMavCWJlEuGLgOx5zgBdQCQ0Zxj7MB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGD
kdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5k
aXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBK
BgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwv
V2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYoAMIGGAkEQ
XFKpUB99oxOp7uK3GztZblTr8DECjcwbJOXYfZLGyfzzNIKPMGPkBGNmGkP7Ie1G
RSCNRsI1VR8/geUR0YUrpwJBRZWF4DZM3cga+6VB7pEv/7r/pQERs/ivzckNwDLi
/LK1pbHc/MeNOdoy7TouLf1djsw40VYtGNT7/9FldHoWqsA=
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/cloud_wmnet_ca
-    db_host          => localhost
-    default_usages   => ['digital signature', 'key encipherment', 'server auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => fake

-    ca_file          => /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    ca_key_file      => /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/cloud_wmnet_ca
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Logrotate::Conf[cfssl-ocsprefresh-kafka]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-kafka].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-kafka]

-    ensure => present

Service[cfssl-ocsprefresh-aux_front_proxy.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-aux_front_proxy.timer].orig
+++ Service[cfssl-ocsprefresh-aux_front_proxy.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Profile::Pki::Multirootca::Monitoring[kafka]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[kafka].orig
+++ Profile::Pki::Multirootca::Monitoring[kafka]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/kafka/ca/kafka.pem
-    intermediate => kafka

Cfssl::Config[puppet_rsa]

Parameters differences:

--- Cfssl::Config[puppet_rsa].orig
+++ Cfssl::Config[puppet_rsa]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/puppet_rsa
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/puppet_rsa/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'mtls': {'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/puppet_rsa

Systemd::Unit[cfssl-ocsprefresh-mlserve.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-mlserve.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_debmonitor.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Timer[cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ Systemd::Timer[cfssl-ocsprefresh-mlserve_front_proxy]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-mlserve_front_proxy.service

File[/etc/update-motd.d/05-insetup--infrastructure-foundations-ferm]

Parameters differences:

--- File[/etc/update-motd.d/05-insetup--infrastructure-foundations-ferm].orig
+++ File[/etc/update-motd.d/05-insetup--infrastructure-foundations-ferm]

+    mode   => 0555
+    owner  => root
+    group  => root
+    ensure => present

Content differences:

--- /etc/update-motd.d/05-insetup--infrastructure-foundations-ferm.orig
+++ /etc/update-motd.d/05-insetup--infrastructure-foundations-ferm
@@ -0,0 +1,2 @@
+#!/bin/sh
+printf "%s\n" "pki1001 is a Host being setup by Infrastructure Foundations SREs with ferm (insetup::infrastructure_foundations_ferm)"

File[/var/lib/prometheus/node.d/role_owner.prom]

Content differences:

--- /var/lib/prometheus/node.d/role_owner.prom.orig
+++ /var/lib/prometheus/node.d/role_owner.prom
@@ -1,3 +1,3 @@
 # HELP role_owner The team owner of the server role
 # TYPE role_owner gauge
-role_owner{team="infrastructure-foundations",role="pki::multirootca",cluster="pki"} 1.0
+role_owner{team="infrastructure-foundations",role="insetup::infrastructure_foundations_ferm",cluster="insetup"} 1.0

Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-aux_front_proxy.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/signers/network_devices/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/network_devices/cfssl.conf].orig
+++ File[/etc/cfssl/signers/network_devices/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/network_devices/cfssl.conf.orig
+++ /etc/cfssl/signers/network_devices/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth"
-      ],
-      "expiry": "8760h",
-      "crl_url": "http://pki.discovery.wmnet/crl/network_devices",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/network_devices"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/var/log/cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-debmonitor].orig
+++ File[/var/log/cfssl-ocsprefresh-debmonitor]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_discovery.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_discovery]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem

File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Systemd::Syslog[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-puppet_rsa-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry --cert-path /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --outfile /var/lib/prometheus/node.d/puppet_rsa_intermediate.prom

Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@syslog]']
-    command     => /bin/systemctl daemon-reload

Cfssl::Config[cloud_wmnet_ca]

Parameters differences:

--- Cfssl::Config[cloud_wmnet_ca].orig
+++ Cfssl::Config[cloud_wmnet_ca]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/cloud_wmnet_ca
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/cloud_wmnet_ca

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Monitoring::Service[check_certificate_expiry_debmonitor]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_debmonitor].orig
+++ Monitoring::Service[check_certificate_expiry_debmonitor]

-    check_command  => nrpe_check!check_check_certificate_expiry_debmonitor!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: debmonitor
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem].orig
+++ File[/etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem.orig
+++ /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem
@@ -1 +0,0 @@
-nosecret

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

File[/etc/cfssl/signers/syslog/ca]

Parameters differences:

--- File[/etc/cfssl/signers/syslog/ca].orig
+++ File[/etc/cfssl/signers/syslog/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - wikikube
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube/ca/wikikube.pem --responses-file /etc/cfssl/ocsp/wikikube.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube' wikikube

Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - mlserve_front_proxy
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --responses-file /etc/cfssl/ocsp/mlserve_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_front_proxy' mlserve_front_proxy

File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux_front_proxy].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service

File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Service[cfssl-ocspserve@cassandra]

Parameters differences:

--- Service[cfssl-ocspserve@cassandra].orig
+++ Service[cfssl-ocspserve@cassandra]

-    ensure => running
-    enable => True

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-wikikube_staging_front_proxy-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_front_proxy_intermediate.prom

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-wikikube_staging-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_intermediate.prom

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Service[nrpe2nodexp-check_certificate_expiry_syslog]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_syslog].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_syslog]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Profile::Pki::Multirootca::Monitoring[mlserve_staging]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[mlserve_staging].orig
+++ Profile::Pki::Multirootca::Monitoring[mlserve_staging]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
-    intermediate => mlserve_staging

Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Class[Profile::Base]

Parameters differences:

--- Class[Profile::Base].orig
+++ Class[Profile::Base]

@@
-    cluster => pki
+    cluster => insetup

Systemd::Timer[cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ Systemd::Timer[cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-wikikube_staging_front_proxy.service

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_aux" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Rsyslog::Conf[cfssl-ocsprefresh-kafka]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-kafka].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-kafka]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-kafka]
-    ensure   => present
-    priority => 40

File[/etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods]

Parameters differences:

--- File[/etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods].orig
+++ File[/etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods]

-    mode    => 0400
-    require => File[/etc/ferm/conf.d]
-    tag     => ferm
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[ferm]

Content differences:

--- /etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods.orig
+++ /etc/ferm/conf.d/10_multirootca_tls_termination_for_cfssl_issuer_k8s_pods
@@ -1,6 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 
-&R_SERVICE(tcp, 8443, ($WIKIKUBE_KUBEPODS_NETWORKS $STAGING_KUBEPODS_NETWORKS $MLSERVE_KUBEPODS_NETWORKS $MLSTAGE_KUBEPODS_NETWORKS $DSE_KUBEPODS_NETWORKS $AUX_KUBEPODS_NETWORKS));
-
-

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_mlserve
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "bfd2f7c6497e1da6323bef48d24f9e8e" --timeout 10 --check-command "check_check_certificate_expiry_mlserve"

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]
-    ensure   => present
-    priority => 40

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_mlserve_staging
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem

Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_front_proxy_9d6dd05c8e5e1bb294462d932b24bd1a]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_front_proxy_9d6dd05c8e5e1bb294462d932b24bd1a].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_mlserve_front_proxy_9d6dd05c8e5e1bb294462d932b24bd1a]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_mlserve_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_front_proxy
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: mlserve_front_proxy
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="9d6dd05c8e5e1bb294462d932b24bd1a",check_name="check_check_certificate_expiry_mlserve_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__mlserve_front_proxy
-    group              => nrpechecks
-    severity           => info

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[wmf_auto_restart_apache-htcacheclean.timer]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_apache-htcacheclean.timer].orig
+++ Systemd::Unit[wmf_auto_restart_apache-htcacheclean.timer]

-    override          => False
-    unit              => wmf_auto_restart_apache-htcacheclean.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/ocsp/mlserve_staging.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/mlserve_staging.ocsp].orig
+++ File[/etc/cfssl/ocsp/mlserve_staging.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.service (nrpe2nodexp-check_certificate_expiry_network_devices.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_network_devices.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_network_devices command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_network_devices
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "21dac3775d059b8c991626e2ca33f951" --timeout 10 --check-command "check_check_certificate_expiry_network_devices"

Prometheus::Blackbox::Check::Http[PKI_dse_front_proxy]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_dse_front_proxy].orig
+++ Prometheus::Blackbox::Check::Http[PKI_dse_front_proxy]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"dse_front_proxy"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux_front_proxy].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_aux_front_proxy]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_aux_front_proxy!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: aux_front_proxy
-    check_interval         => 1

Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    ensure => present

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.service (nrpe2nodexp-check_certificate_expiry_discovery.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_discovery command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_discovery
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "38e4dbcfd07ed60daf5bb89397abbe29" --timeout 10 --check-command "check_check_certificate_expiry_discovery"

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Timer[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service

File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Cfssl::Config[discovery]

Parameters differences:

--- Cfssl::Config[discovery].orig
+++ Cfssl::Config[discovery]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/discovery
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/discovery/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/discovery

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-mlserve_staging_front_proxy
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-mlserve_staging_front_proxy
-
-/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Service[cfssl-ocspserve@mlserve]

Parameters differences:

--- Service[cfssl-ocspserve@mlserve].orig
+++ Service[cfssl-ocspserve@mlserve]

-    ensure => running
-    enable => True

Profile::Pki::Multirootca::Monitoring[wikikube_front_proxy]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[wikikube_front_proxy].orig
+++ Profile::Pki::Multirootca::Monitoring[wikikube_front_proxy]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
-    intermediate => wikikube_front_proxy

Cfssl::Signer[syslog]

Parameters differences:

--- Cfssl::Signer[syslog].orig
+++ Cfssl::Signer[syslog]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDqTCCAwqgAwIBAgIUI5/ixOCtnw8ZXV6xWw6RVC/D6rwwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwOTI4MTAzNzAwWhcNMjgwOTI2MTAzNzAwWjB0
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMQ8wDQYDVQQDEwZzeXNsb2cwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABL
CaZwsDnVcBhApShaeA1j8/9w4S2re0Zmjx7GTeBXiJcKF0dAhgAQRCMrGtWEimmQ
W94s5015H1MknO61lLOY+wDAFYkq98rZF2aRRILm1w/5iRkqTDiBECBVE15jrPzD
q4zZCQ5V5ellWhzfGfPMxFOogIm1sqZsqZvB7zZaCSOrbaOCAQwwggEIMA4GA1Ud
DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRvwMc33QVQ
qaT1dZmUUtkBeYiyzjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBW
BggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5
LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMw
QTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRp
YV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAUtK7APyQamN
8DYOBCd1wJQ1DbYlzcQOcupJns2RKKcxFp1evo2GQjDA15TN1OXtA+pvK/liCAEh
p828+NcE6fPMAkIBN/Yjhvy0lrtVzshqckUEciShFhbDU0QZOHuzIXCVjdskzQfu
as4ZMO15kIv0MZUJ6V9aKEE6nqzi9QXifjuoY54=
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/syslog
-    db_host          => localhost
-    default_usages   => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => nosecret

-    ca_file          => /etc/cfssl/signers/syslog/ca/syslog.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    ca_key_file      => /etc/cfssl/signers/syslog/ca/syslog-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/syslog
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Prometheus::Blackbox::Check::Http[PKI_debmonitor]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_debmonitor].orig
+++ Prometheus::Blackbox::Check::Http[PKI_debmonitor]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"debmonitor"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

File[/etc/cfssl/signers/cassandra]

Parameters differences:

--- File[/etc/cfssl/signers/cassandra].orig
+++ File[/etc/cfssl/signers/cassandra]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/etc/cfssl/signers/dse]

Parameters differences:

--- File[/etc/cfssl/signers/dse].orig
+++ File[/etc/cfssl/signers/dse]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Systemd::Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_kafka.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_kafka.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_kafka.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - puppet_rsa
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --responses-file /etc/cfssl/ocsp/puppet_rsa.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@puppet_rsa' puppet_rsa

Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging -profile ocsp /etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet

Nrpe::Check[check_check_certificate_expiry_kafka]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_kafka].orig
+++ Nrpe::Check[check_check_certificate_expiry_kafka]

-    before    => Monitoring::Service[check_certificate_expiry_kafka]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/kafka/ca/kafka.pem

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_zuul]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_zuul].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_zuul]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_zuul.service

File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Service[cfssl-ocspserve@mlserve_staging_front_proxy]

Parameters differences:

--- Service[cfssl-ocspserve@mlserve_staging_front_proxy].orig
+++ Service[cfssl-ocspserve@mlserve_staging_front_proxy]

-    ensure => running
-    enable => True

File[/etc/apache2/sites-enabled/50-pki-discovery-wmnet.conf]

Parameters differences:

--- File[/etc/apache2/sites-enabled/50-pki-discovery-wmnet.conf].orig
+++ File[/etc/apache2/sites-enabled/50-pki-discovery-wmnet.conf]

-    target => /etc/apache2/sites-available/50-pki-discovery-wmnet.conf
-    ensure => link
-    owner  => root
-    group  => root
-    notify => Service[apache2]

File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-discovery2026.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-discovery2026.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-discovery2026.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Rsyslog::Conf[cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-puppet_rsa].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-puppet_rsa]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-puppet_rsa]
-    ensure   => present
-    priority => 40

File[/etc/logrotate.d/cfssl-ocsprefresh-etcd]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-etcd].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-etcd]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-etcd.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-etcd
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-etcd
-
-/var/log/cfssl-ocsprefresh-etcd/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Prometheus::Alert::Rule[check_check_certificate_expiry_syslog_e3b9b989d5062ce2d267023dfe42fcd8]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_syslog_e3b9b989d5062ce2d267023dfe42fcd8].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_syslog_e3b9b989d5062ce2d267023dfe42fcd8]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_syslog))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: syslog
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: syslog
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="e3b9b989d5062ce2d267023dfe42fcd8",check_name="check_check_certificate_expiry_syslog", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__syslog
-    group              => nrpechecks
-    severity           => info

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_dse]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_dse!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: dse
-    check_interval         => 1

Exec[ensure_present_mod_status]

Parameters differences:

--- Exec[ensure_present_mod_status].orig
+++ Exec[ensure_present_mod_status]

-    require => Package[apache2]
-    creates => /etc/apache2/mods-enabled/status.load
-    notify  => Service[apache2]
-    command => /usr/sbin/a2enmod status

File[/etc/rsyslog.d/40-cfssl-gc-expired-certs.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-gc-expired-certs.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-gc-expired-certs.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-gc-expired-certs.conf.orig
+++ /etc/rsyslog.d/40-cfssl-gc-expired-certs.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-gc-expired-certs" then {
-    action(
-        type="omfile" file="/var/log/cfssl-gc-expired-certs/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Service[cfssl-ocspserve@network_devices]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@network_devices].orig
+++ Systemd::Service[cfssl-ocspserve@network_devices]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Exec[renew certificate - OCSP_cassandra_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_cassandra_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_cassandra_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cassandra -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet

File[/var/log/cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-discovery2026].orig
+++ File[/var/log/cfssl-ocsprefresh-discovery2026]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]
-    ensure   => present
-    priority => 40

Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@cloud_wmnet_ca]']
-    command     => /bin/systemctl daemon-reload

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_staging.prom]

-    owner  => root
-    group  => root
-    ensure => absent

File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Service[nrpe2nodexp-check_certificate_expiry_dse.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_dse.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_dse.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.timer (nrpe2nodexp-check_certificate_expiry_dse.timer)]']

Cfssl::Cert[puppet_rsa__pki_discovery_wmnet]

Parameters differences:

--- Cfssl::Cert[puppet_rsa__pki_discovery_wmnet].orig
+++ Cfssl::Cert[puppet_rsa__pki_discovery_wmnet]

-    hosts           => ['pki1001.eqiad.wmnet']
-    names           => []
-    owner           => root
-    common_name     => pki.discovery.wmnet
-    renew_seconds   => 952200
-    provide_chain   => True
-    auto_renew      => True
-    mode            => 0740
-    notify_services => ['apache2']
-    before_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => puppet_rsa
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root

File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-mlserve_front_proxy
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-mlserve_front_proxy
-
-/var/log/cfssl-ocsprefresh-mlserve_front_proxy/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-aux-front-proxy.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_aux_front_proxy" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Timer[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service

Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_wikikube.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_wikikube.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-aux_front_proxy-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --outfile /var/lib/prometheus/node.d/aux_front_proxy_intermediate.prom

File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.service (cfssl-ocsprefresh-discovery.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-discovery.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-discovery.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - discovery
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery/ca/discovery.pem --responses-file /etc/cfssl/ocsp/discovery.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery' discovery

Monitoring::Exported_nagios_service[pki1001 raid_md]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 raid_md].orig
+++ Monitoring::Exported_nagios_service[pki1001 raid_md]

@@
-    notifications_enabled => 1
+    notifications_enabled => 0
@@
-    servicegroups         => pki_eqiad
+    servicegroups         => insetup_eqiad

File[/var/log/wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- File[/var/log/wmf_auto_restart_apache-htcacheclean].orig
+++ File[/var/log/wmf_auto_restart_apache-htcacheclean]

-    mode   => 0755
-    force  => True
-    ensure => absent
-    owner  => root
-    backup => False
-    group  => root

Systemd::Unit[cfssl-ocsprefresh-zuul.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-zuul.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-zuul.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-zuul.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Prometheus::Alert::Rule[check_check_certificate_expiry_aux_f7dfe9e2cd77303dfae7ae11c5c56d90]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_aux_f7dfe9e2cd77303dfae7ae11c5c56d90].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_aux_f7dfe9e2cd77303dfae7ae11c5c56d90]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_aux))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: aux
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: aux
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="f7dfe9e2cd77303dfae7ae11c5c56d90",check_name="check_check_certificate_expiry_aux", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__aux
-    group              => nrpechecks
-    severity           => info

File[/etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-cfssl-multirootca-status.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_cfssl-multirootca_status" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_dse]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_dse.service

File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.service (cfssl-ocsprefresh-debmonitor.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-debmonitor.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-debmonitor.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - debmonitor
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --responses-file /etc/cfssl/ocsp/debmonitor.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@debmonitor' debmonitor

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-discovery2026-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-discovery2026-certificate-expiry --cert-path /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --outfile /var/lib/prometheus/node.d/discovery2026_intermediate.prom

Monitoring::Service[check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_dse_front_proxy].orig
+++ Monitoring::Service[check_certificate_expiry_dse_front_proxy]

-    check_command  => nrpe_check!check_check_certificate_expiry_dse_front_proxy!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: dse_front_proxy
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

File[/srv/cfssl/bundles/discovery.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/discovery.pem].orig
+++ File[/srv/cfssl/bundles/discovery.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/discovery.pem.orig
+++ /srv/cfssl/bundles/discovery.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrDCCAw2gAwIBAgIUcVMxEVtp5xErDjx/jInOFcUaRjkwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjEwNTA0MTM1NDAwWhcNMjYwNTAzMTM1NDAwWjB3
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRIwEAYDVQQDEwlkaXNjb3ZlcnkwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
-BAG7X6lQ05D8EQYwPd+v2qT12Y35j/YQTaOEbAuKQJBshTdMizCxGe4GUB33Nivw
-3B0o9EcyCQokcUCUGtVlI3U0QQArB+LuehDTw7D5JKwOUK5GpSG5YlNL7Kg2c3gI
-wyck1+Z5yDMIsclW5FtaM1IIFeUIOXrulmih3zM4PPrVtP3Vh6OCAQwwggEIMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSJ76Rw
-5IjvCdxrdGkh4PHUL7PCBjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
-NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
-ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
-BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
-ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAeamwKAw
-q+lKC/GdcPuP2SOoyij0+LFWucrQwxxiCiXlMAhSnj3fkKk5G5pLoFnY2X7hB0w4
-ZPtLXG7If9pmIDjwAkIBwnJUYLz3dJTbZudeUJFX4yD49liKTYMPDpl/HWKSh9m4
-4PZKXsAIs4CT29jwwtmsLK1HkPB0ShO8Egm/KB5dLUs=
------END CERTIFICATE-----

Systemd::Service[cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ Systemd::Service[cfssl-ocsprefresh-wikikube_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-mlserve_staging" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-mlserve_staging/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    ensure => present

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/signers/aux/ca]

Parameters differences:

--- File[/etc/cfssl/signers/aux/ca].orig
+++ File[/etc/cfssl/signers/aux/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/etc/cfssl/ssl/ocsp]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp].orig
+++ File[/etc/cfssl/ssl/ocsp]

-    mode    => 0740
-    ensure  => directory
-    owner   => root
-    group   => root
-    recurse => True

Systemd::Timer::Job[cfssl-ocsprefresh-discovery]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-discovery].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-discovery]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - discovery
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery/ca/discovery.pem --responses-file /etc/cfssl/ocsp/discovery.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery' discovery

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/signers/wikikube_front_proxy]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_front_proxy].orig
+++ File[/etc/cfssl/signers/wikikube_front_proxy]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_discovery!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: discovery
-    check_interval         => 1

File[/etc/cfssl/signers/wikikube]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube].orig
+++ File[/etc/cfssl/signers/wikikube]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/etc/apache2/conf-enabled/00-defaults.conf]

Parameters differences:

--- File[/etc/apache2/conf-enabled/00-defaults.conf].orig
+++ File[/etc/apache2/conf-enabled/00-defaults.conf]

-    target => /etc/apache2/conf-available/00-defaults.conf
-    ensure => link
-    owner  => root
-    group  => root
-    notify => Service[apache2]

Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-aux-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.timer (nrpe2nodexp-check_certificate_expiry_discovery2026.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_discovery2026.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_discovery2026.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Monitoring::Service[check_certificate_expiry_mlserve_staging_front_proxy]

-    check_command  => nrpe_check!check_check_certificate_expiry_mlserve_staging_front_proxy!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Systemd::Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_zuul]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_zuul].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_zuul]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Logrotate::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-cloud_wmnet_ca]

-    ensure => present

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]']

Systemd::Unit[cfssl-ocsprefresh-aux.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-aux.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-aux.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-aux.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem].orig
+++ Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]

-    require   => Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change]
-    subscribe => ['Exec[renew certificate - puppet_rsa__pki_discovery_wmnet]', 'File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]', 'File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem]']
-    unless    => /usr/bin/test "$(/bin/cat /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem | sha512sum)" == "$(/bin/cat /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem | sha512sum)"

-    notify    => ['Service[apache2]']
-    command   => /bin/cat /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem > /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem

Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@aux]']
-    command     => /bin/systemctl daemon-reload

Service[cfssl-ocsprefresh-wikikube_staging.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-wikikube_staging.timer].orig
+++ Service[cfssl-ocsprefresh-wikikube_staging.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Prometheus::Blackbox::Check::Http[PKI_wikikube_front_proxy]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_wikikube_front_proxy].orig
+++ Prometheus::Blackbox::Check::Http[PKI_wikikube_front_proxy]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"wikikube_front_proxy"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]

-    hosts       => ['pki1001.eqiad.wmnet']
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki.discovery.wmnet

Rsyslog::Conf[cfssl-ocsprefresh-dse]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-dse].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-dse]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-dse]
-    ensure   => present
-    priority => 40

Logrotate::Conf[cfssl-ocsprefresh-mlserve]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-mlserve].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-mlserve]

-    ensure => present

File[/etc/logrotate.d/wmf_auto_restart_apache2]

Parameters differences:

--- File[/etc/logrotate.d/wmf_auto_restart_apache2].orig
+++ File[/etc/logrotate.d/wmf_auto_restart_apache2]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/wmf_auto_restart_apache2.orig
+++ /etc/logrotate.d/wmf_auto_restart_apache2
@@ -1,12 +0,0 @@
-# logrotate(8) config for wmf_auto_restart_apache2
-
-/var/log/wmf_auto_restart_apache2/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[Generate initial CRL for mlserve]

Parameters differences:

--- Exec[Generate initial CRL for mlserve].orig
+++ Exec[Generate initial CRL for mlserve]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/mlserve
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/mlserve/ca/mlserve.pem /etc/cfssl/signers/mlserve/ca/mlserve-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/mlserve

File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]

Parameters differences:

--- File[/usr/local/lib/nagios/plugins/check_systemd_unit_status].orig
+++ File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]

-    mode    => 0555
-    require => File[/usr/local/lib/nagios/plugins/]
-    source  => puppet:///modules/systemd/check_systemd_unit_status
-    ensure  => file
-    tag     => nrpe::plugin
-    owner   => root
-    group   => root

Monitoring::Exported_nagios_host[pki1001]

Parameters differences:

--- Monitoring::Exported_nagios_host[pki1001].orig
+++ Monitoring::Exported_nagios_host[pki1001]

@@
-    notifications_enabled => 1
+    notifications_enabled => 0
@@
-    hostgroups            => pki_eqiad,asw2-a-eqiad
+    hostgroups            => insetup_eqiad,asw2-a-eqiad

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-wikikube_front_proxy-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_front_proxy_intermediate.prom

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-wikikube" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-wikikube/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/var/log/cfssl-ocsprefresh-kafka]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-kafka].orig
+++ File[/var/log/cfssl-ocsprefresh-kafka]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@mlserve_staging]']
-    command     => /bin/systemctl daemon-reload

Exec[Generate initial CRL for cassandra]

Parameters differences:

--- Exec[Generate initial CRL for cassandra].orig
+++ Exec[Generate initial CRL for cassandra]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/cassandra
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/cassandra/ca/cassandra.pem /etc/cfssl/signers/cassandra/ca/cassandra-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/cassandra

Profile::Auto_restarts::Service[apache-htcacheclean]

Parameters differences:

--- Profile::Auto_restarts::Service[apache-htcacheclean].orig
+++ Profile::Auto_restarts::Service[apache-htcacheclean]

-    ensure => absent

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.timer]']

Exec[ensure_present_mod_access_compat]

Parameters differences:

--- Exec[ensure_present_mod_access_compat].orig
+++ Exec[ensure_present_mod_access_compat]

-    require => Package[apache2]
-    creates => /etc/apache2/mods-enabled/access_compat.load
-    notify  => Service[apache2]
-    command => /usr/sbin/a2enmod access_compat

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer (nrpe2nodexp-check_certificate_expiry_puppet_rsa.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_kafka]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_kafka].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_kafka]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_kafka!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: kafka
-    check_interval         => 1

Sudo::User[nrpe_certificate_check_wikikube_staging]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_wikikube_staging].orig
+++ Sudo::User[nrpe_certificate_check_wikikube_staging]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_wikikube_staging

Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.service (cfssl-ocsprefresh-kafka.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[renew certificate - OCSP_wikikube_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_wikikube_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_wikikube_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]
-    ensure   => present
-    priority => 40

File[/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf].orig
+++ File[/etc/cfssl/signers/wikikube_front_proxy/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/wikikube_front_proxy/cfssl.conf.orig
+++ /etc/cfssl/signers/wikikube_front_proxy/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/wikikube_front_proxy",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/wikikube_front_proxy"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Systemd::Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/cfssl/signers/debmonitor/ca]

Parameters differences:

--- File[/etc/cfssl/signers/debmonitor/ca].orig
+++ File[/etc/cfssl/signers/debmonitor/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/lib/systemd/system/cfssl-ocspserve@kafka.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@kafka.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@kafka.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@kafka.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@kafka.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (kafka)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10003 \
-          -responses /etc/cfssl/ocsp/kafka.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Exec[renew certificate - OCSP_mlserve_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_mlserve_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_mlserve_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet

File[/etc/apache2/sites-available/50-pki-discovery-wmnet.conf]

Parameters differences:

--- File[/etc/apache2/sites-available/50-pki-discovery-wmnet.conf].orig
+++ File[/etc/apache2/sites-available/50-pki-discovery-wmnet.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[apache2]

Content differences:

--- /etc/apache2/sites-available/50-pki-discovery-wmnet.conf.orig
+++ /etc/apache2/sites-available/50-pki-discovery-wmnet.conf
@@ -1,149 +0,0 @@
-#####################################################################
-
-### THIS FILE IS MANAGED BY PUPPET
-#####################################################################
-# vim: filetype=apache
-<VirtualHost *:80>
-  ServerName pki.discovery.wmnet
-  ServerAlias pki1001.eqiad.wmnet
-  DocumentRoot /srv/cfssl
-
-  <Directory  /srv/cfssl>
-    Require all granted
-  </Directory>
-
-  <Location /metrics>
-    Require host prometheus1005.eqiad.wmnet prometheus1006.eqiad.wmnet prometheus1007.eqiad.wmnet prometheus1008.eqiad.wmnet
-    ProxyPass http://127.0.0.1:8888/metrics
-    ProxyPassReverse http://127.0.0.1:8888/metrics
-  </Location>
-
-  # Wikimedia_Internal_Root_CA
-  ProxyPass /ocsp/Wikimedia_Internal_Root_CA  http://localhost:10000/
-  ProxyPassReverse /ocsp/Wikimedia_Internal_Root_CA  http://localhost:10000/
-  # debmonitor
-  ProxyPass /ocsp/debmonitor  http://localhost:10001/
-  ProxyPassReverse /ocsp/debmonitor  http://localhost:10001/
-  # discovery
-  ProxyPass /ocsp/discovery  http://localhost:10002/
-  ProxyPassReverse /ocsp/discovery  http://localhost:10002/
-  # kafka
-  ProxyPass /ocsp/kafka  http://localhost:10003/
-  ProxyPassReverse /ocsp/kafka  http://localhost:10003/
-  # cloud_wmnet_ca
-  ProxyPass /ocsp/cloud_wmnet_ca  http://localhost:10004/
-  ProxyPassReverse /ocsp/cloud_wmnet_ca  http://localhost:10004/
-  # etcd
-  ProxyPass /ocsp/etcd  http://localhost:10005/
-  ProxyPassReverse /ocsp/etcd  http://localhost:10005/
-  # cassandra
-  ProxyPass /ocsp/cassandra  http://localhost:10006/
-  ProxyPassReverse /ocsp/cassandra  http://localhost:10006/
-  # syslog
-  ProxyPass /ocsp/syslog  http://localhost:10007/
-  ProxyPassReverse /ocsp/syslog  http://localhost:10007/
-  # puppet_rsa
-  ProxyPass /ocsp/puppet_rsa  http://localhost:10008/
-  ProxyPassReverse /ocsp/puppet_rsa  http://localhost:10008/
-  # zuul
-  ProxyPass /ocsp/zuul  http://localhost:10009/
-  ProxyPassReverse /ocsp/zuul  http://localhost:10009/
-  # discovery2026
-  ProxyPass /ocsp/discovery2026  http://localhost:10010/
-  ProxyPassReverse /ocsp/discovery2026  http://localhost:10010/
-  # wikikube
-  ProxyPass /ocsp/wikikube  http://localhost:20010/
-  ProxyPassReverse /ocsp/wikikube  http://localhost:20010/
-  # wikikube_front_proxy
-  ProxyPass /ocsp/wikikube_front_proxy  http://localhost:20011/
-  ProxyPassReverse /ocsp/wikikube_front_proxy  http://localhost:20011/
-  # wikikube_staging
-  ProxyPass /ocsp/wikikube_staging  http://localhost:20020/
-  ProxyPassReverse /ocsp/wikikube_staging  http://localhost:20020/
-  # wikikube_staging_front_proxy
-  ProxyPass /ocsp/wikikube_staging_front_proxy  http://localhost:20021/
-  ProxyPassReverse /ocsp/wikikube_staging_front_proxy  http://localhost:20021/
-  # mlserve
-  ProxyPass /ocsp/mlserve  http://localhost:20030/
-  ProxyPassReverse /ocsp/mlserve  http://localhost:20030/
-  # mlserve_front_proxy
-  ProxyPass /ocsp/mlserve_front_proxy  http://localhost:20031/
-  ProxyPassReverse /ocsp/mlserve_front_proxy  http://localhost:20031/
-  # mlserve_staging
-  ProxyPass /ocsp/mlserve_staging  http://localhost:20040/
-  ProxyPassReverse /ocsp/mlserve_staging  http://localhost:20040/
-  # mlserve_staging_front_proxy
-  ProxyPass /ocsp/mlserve_staging_front_proxy  http://localhost:20041/
-  ProxyPassReverse /ocsp/mlserve_staging_front_proxy  http://localhost:20041/
-  # aux
-  ProxyPass /ocsp/aux  http://localhost:20050/
-  ProxyPassReverse /ocsp/aux  http://localhost:20050/
-  # aux_front_proxy
-  ProxyPass /ocsp/aux_front_proxy  http://localhost:20051/
-  ProxyPassReverse /ocsp/aux_front_proxy  http://localhost:20051/
-  # dse
-  ProxyPass /ocsp/dse  http://localhost:20061/
-  ProxyPassReverse /ocsp/dse  http://localhost:20061/
-  # dse_front_proxy
-  ProxyPass /ocsp/dse_front_proxy  http://localhost:20062/
-  ProxyPassReverse /ocsp/dse_front_proxy  http://localhost:20062/
-  # network_devices
-  ProxyPass /ocsp/network_devices  http://localhost:20063/
-  ProxyPassReverse /ocsp/network_devices  http://localhost:20063/
-
-  LogLevel warn
-  ErrorLog /var/log/apache2/pki.discovery.wmnet_error.log
-  CustomLog /var/log/apache2/pki.discovery.wmnet_access.log wmf
-</VirtualHost>
-
-<VirtualHost *:443>
-  # Protected by client auth
-  ServerName pki.discovery.wmnet
-  ServerAlias pki1001.eqiad.wmnet
-  DocumentRoot /srv/cfssl
-
-  SSLEngine on
-  SSLCertificateFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem
-  SSLCertificateKeyFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem
-  SSLCertificateChainFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem
-  SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
-  SSLCipherSuite -ALL:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256
-  SSLCipherSuite TLSv1.3 TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
-  SSLHonorCipherOrder On
-  SSLOpenSSLConfCmd DHParameters "/etc/ssl/dhparam.pem"
-  Header always set Strict-Transport-Security "max-age=106384710; includeSubDomains; preload"
-  SSLVerifyClient require
-  SSLVerifyDepth 2
-  SSLCACertificateFile /etc/ssl/localcerts/multiroot_ca.pem
-
-  ProxyPass /  http://127.0.0.1:8888/
-  ProxyPassReverse / http://127.0.0.1:8888/
-
-  LogLevel warn ssl:info
-  ErrorLog /var/log/apache2/pki.discovery.wmnet_ssl_error.log
-  CustomLog /var/log/apache2/pki.discovery.wmnet_ssl_access.log wmf
-</VirtualHost>
-<VirtualHost *:8443>
-  # Protected by iptables
-  ServerName pki.discovery.wmnet
-  ServerAlias pki1001.eqiad.wmnet
-  DocumentRoot /srv/cfssl
-
-  SSLEngine on
-  SSLCertificateFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem
-  SSLCertificateKeyFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem
-  SSLCertificateChainFile /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem
-  SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
-  SSLCipherSuite -ALL:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256
-  SSLCipherSuite TLSv1.3 TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
-  SSLHonorCipherOrder On
-  SSLOpenSSLConfCmd DHParameters "/etc/ssl/dhparam.pem"
-  Header always set Strict-Transport-Security "max-age=106384710; includeSubDomains; preload"
-
-  ProxyPass /  http://127.0.0.1:8888/
-  ProxyPassReverse / http://127.0.0.1:8888/
-
-  LogLevel warn ssl:info
-  ErrorLog /var/log/apache2/pki.discovery.wmnet_k8s_error.log
-  CustomLog /var/log/apache2/pki.discovery.wmnet_k8s_access.log wmf
-</VirtualHost>

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.timer (cfssl-ocsprefresh-wikikube.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-wikikube.timer]']

File[/etc/sudoers.d/nrpe_certificate_check_network_devices]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_network_devices].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_network_devices]

-    owner  => root
-    group  => root
-    ensure => absent

Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve -profile ocsp /etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet

Service[cfssl-ocspserve@mlserve_front_proxy]

Parameters differences:

--- Service[cfssl-ocspserve@mlserve_front_proxy].orig
+++ Service[cfssl-ocspserve@mlserve_front_proxy]

-    ensure => running
-    enable => True

Systemd::Service[cfssl-ocsprefresh-wikikube]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-wikikube].orig
+++ Systemd::Service[cfssl-ocsprefresh-wikikube]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-wikikube.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Service[nrpe2nodexp-check_certificate_expiry_discovery.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_discovery.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_discovery.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]']

File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem].orig
+++ File[/etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem.orig
+++ /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem
@@ -1 +0,0 @@
-nosecret

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_zuul
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem

File[/usr/local/bin/prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-etcd-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-etcd-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube_staging_front_proxy.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-wikikube_staging_front_proxy.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    ensure => present

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Cfssl::Cert[OCSP_syslog_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_syslog_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_syslog_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-syslog]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => syslog
-    notify          => Service[cfssl-ocspserve@syslog]
-    profile         => ocsp

Systemd::Override[apache2-after-network-online-target]

Parameters differences:

--- Systemd::Override[apache2-after-network-online-target].orig
+++ Systemd::Override[apache2-after-network-online-target]

-    unit    => apache2
-    ensure  => absent
-    restart => False

Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet

File[/etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-aux_front_proxy
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-aux_front_proxy
-
-/var/log/cfssl-ocsprefresh-aux_front_proxy/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Rsyslog::Conf[cfssl-ocsprefresh-cassandra]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-cassandra].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-cassandra]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-cassandra]
-    ensure   => present
-    priority => 40

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[cfssl-ocspserve@aux]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@aux].orig
+++ Systemd::Unit[cfssl-ocspserve@aux]

-    override          => False
-    unit              => cfssl-ocspserve@aux
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Sudo::User[nrpe-check_check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_puppet_rsa].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_puppet_rsa]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem']
-    user       => nagios

File[/lib/systemd/system/cfssl-ocsprefresh-etcd.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-etcd.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-etcd.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-etcd.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-etcd.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-etcd.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-etcd.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Nrpe::Check[check_check_certificate_expiry_mlserve]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_mlserve].orig
+++ Nrpe::Check[check_check_certificate_expiry_mlserve]

-    before    => Monitoring::Service[check_certificate_expiry_mlserve]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve/ca/mlserve.pem

File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-debmonitor.timer (cfssl-ocsprefresh-debmonitor.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-debmonitor.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-debmonitor.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-debmonitor.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-cloud_wmnet_ca]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - cloud_wmnet_ca
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --responses-file /etc/cfssl/ocsp/cloud_wmnet_ca.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@cloud_wmnet_ca' cloud_wmnet_ca

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_staging command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_wikikube_staging
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "f389c556cebfcfc345b3d6802f320045" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_staging"

File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-wikikube_staging_front_proxy
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-wikikube_staging_front_proxy
-
-/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label kafka -profile ocsp /etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet

File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-wikikube.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-wikikube
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-wikikube
-
-/var/log/cfssl-ocsprefresh-wikikube/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/srv/cfssl/bundles/Puppet_Internal_CA.pem.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/Puppet_Internal_CA.pem.pem].orig
+++ File[/srv/cfssl/bundles/Puppet_Internal_CA.pem.pem]

-    mode   => 0444
-    source => /var/lib/puppet/ssl/certs/ca.pem
-    ensure => file
-    owner  => root
-    group  => root

Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet

File[/etc/sudoers.d/nrpe_certificate_check_puppet_rsa]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_puppet_rsa].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_puppet_rsa]

-    owner  => root
-    group  => root
-    ensure => absent

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Httpd::Mod_conf[access_compat]

Parameters differences:

--- Httpd::Mod_conf[access_compat].orig
+++ Httpd::Mod_conf[access_compat]

-    loadfile => access_compat.load
-    mod      => access_compat
-    ensure   => present

Systemd::Unit[cfssl-ocspserve@mlserve]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@mlserve].orig
+++ Systemd::Unit[cfssl-ocspserve@mlserve]

-    override          => False
-    unit              => cfssl-ocspserve@mlserve
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-cassandra.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.timer (cfssl-ocsprefresh-cassandra.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-cassandra.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-cassandra.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-cassandra.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-cassandra.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_discovery.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)].orig
+++ Exec[systemd daemon-reload for cfssl-multirootca.service (cfssl-multirootca)]

-    refreshonly => True
-    notify      => ['Service[cfssl-multirootca]']
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Service[cfssl-ocspserve@discovery]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@discovery].orig
+++ Systemd::Service[cfssl-ocspserve@discovery]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-mlserve_staging_front_proxy-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_front_proxy_intermediate.prom

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    ensure => present

Class[Profile::Pki::Multirootca]

Parameters differences:

--- Class[Profile::Pki::Multirootca].orig
+++ Class[Profile::Pki::Multirootca]

-    root_ca_cn         => Wikimedia_Internal_Root_CA
-    vhost              => pki.discovery.wmnet
-    enable_k8s_vhost   => True
-    root_ca_cert       => profile/pki/ROOT/Wikimedia_Internal_Root_CA.pem
-    db_host            => m1-master.eqiad.wmnet
-    db_name            => pki
-    default_usages     => ['signing', 'key encipherment', 'client auth']
-    root_ocsp_key      => pki/ROOT/Wikimedia_Internal_Root_CA_ocsp_signing_cert.pem
-    enable_client_auth => True
-    private_cert_base  => pki/intermediates
-    default_nets       => ['127.0.0.1/32']
-    root_ocsp_cert     => profile/pki/ROOT/Wikimedia_Internal_Root_CA_ocsp_signing_cert.pem
-    default_expiry     => 672h
-    db_driver          => mysql
-    default_auth_keys  => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    enable_monitoring  => True
-    default_profiles   => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    client_ca_source   => puppet:///modules/profile/pki/production/client_auth_CA.pem
-    public_cert_base   => profile/pki/intermediates
-    root_ocsp_port     => 10000
-    db_user            => pki
-    cfssl_httpd_cert   => True
-    intermediates      => {'debmonitor': {'ocsp_port': 10001}, 'discovery': {'ocsp_port': 10002, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}}, 'kafka': {'ocsp_port': 10003, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth'], 'profiles': {'kafka_11': {'expiry': '8760h'}}}, 'cloud_wmnet_ca': {'ocsp_port': 10004, 'default_usages': ['digital signature', 'key encipherment', 'server auth']}, 'etcd': {'ocsp_port': 10005, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'cassandra': {'ocsp_port': 10006, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'syslog': {'ocsp_port': 10007, 'default_usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'puppet_rsa': {'ocsp_port': 10008, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'mtls': {'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'zuul': {'ocsp_port': 10009, 'default_usages': ['server auth', 'client auth']}, 'discovery2026': {'ocsp_port': 10010, 'default_usages': ['digital signature', 'key encipherment', 'server auth'], 'profiles': {'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}}, 'wikikube': {'ocsp_port': 20010, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'wikikube_front_proxy': {'ocsp_port': 20011}, 'wikikube_staging': {'ocsp_port': 20020, 'default_expiry': '72h', 'profiles': {'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'wikikube_staging_front_proxy': {'ocsp_port': 20021, 'default_expiry': '72h'}, 'mlserve': {'ocsp_port': 20030, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'mlserve_front_proxy': {'ocsp_port': 20031}, 'mlserve_staging': {'ocsp_port': 20040, 'default_expiry': '72h', 'profiles': {'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'mlserve_staging_front_proxy': {'ocsp_port': 20041, 'default_expiry': '72h'}, 'aux': {'ocsp_port': 20050, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'aux_front_proxy': {'ocsp_port': 20051}, 'dse': {'ocsp_port': 20061, 'profiles': {'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}}, 'dse_front_proxy': {'ocsp_port': 20062}, 'network_devices': {'ocsp_port': 20063, 'default_expiry': '8760h', 'default_usages': ['digital signature', 'key encipherment', 'server auth']}}
-    maintenance_jobs   => True
-    db_pass            => changeme
-    prometheus_nodes   => ['prometheus1005.eqiad.wmnet', 'prometheus1006.eqiad.wmnet', 'prometheus1007.eqiad.wmnet', 'prometheus1008.eqiad.wmnet']

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_zuul.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_zuul.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Cfssl::Ocsp[kafka]

Parameters differences:

--- Cfssl::Ocsp[kafka].orig
+++ Cfssl::Ocsp[kafka]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 10003
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/kafka/ca/kafka.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service

File[/etc/cfssl/signers/etcd/ca/etcd-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/etcd/ca/etcd-key.pem].orig
+++ File[/etc/cfssl/signers/etcd/ca/etcd-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/etcd/ca/etcd-key.pem.orig
+++ /etc/cfssl/signers/etcd/ca/etcd-key.pem
@@ -1 +0,0 @@
-##### FAKE FOR PUPPET ######

Cfssl::Signer[wikikube]

Parameters differences:

--- Cfssl::Signer[wikikube].orig
+++ Cfssl::Signer[wikikube]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDqzCCAwygAwIBAgIUWXrkQs5GEdgVcV7/XAEZOXQLYlowCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB2
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMREwDwYDVQQDEwh3aWtpa3ViZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAE
AX4fMTh3NrBZlCMop5eKr6F/RXTefrSSdu6DE39OOKTTdYM3TxK8tPmTDm9EE+XT
4rO+VHuaIVVirgB2JQtla8oZAZb60Pw8v9BlJ1JLLK9vpWA9Vce7DKmMNxIWK9GA
YIUQufjHVD2eibYJsK54NGkBe3frhPhwayIvzJ3gGO34GRaRo4IBDDCCAQgwDgYD
VR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFAaU1Sae
B9+FDd+SrIADU8yIo+xJMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2
MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zl
cnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8E
QzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1l
ZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBFZVjRbh3
GaouRaz9IPef3q+9s+TleKGby7nJQ6z71M3rpJIsHr9lncr/9GPq5v5cHDYOHmgK
GBupTY7FNMwL8aACQgCgoDP6PO23Dw6tuswLIbeY+o5l3K8R5L3RS1DO59OXXV2f
9FmoJNLgGXgP87rOkFW1fn9/QcvX85zD0urkq8gNjg==
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/wikikube
-    db_host          => localhost
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => test

-    ca_file          => /etc/cfssl/signers/wikikube/ca/wikikube.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    ca_key_file      => /etc/cfssl/signers/wikikube/ca/wikikube-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/wikikube
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Exec[renew certificate - OCSP_zuul_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_zuul_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_zuul_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label zuul -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet

File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-cloud_wmnet_ca-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry --cert-path /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --outfile /var/lib/prometheus/node.d/cloud_wmnet_ca_intermediate.prom

Rsyslog::Conf[cfssl-ocsprefresh-syslog]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-syslog].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-syslog]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-syslog]
-    ensure   => present
-    priority => 40

Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Nrpe::Monitor_service[check_certificate_expiry_network_devices]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_network_devices].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_network_devices]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: network_devices
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

File[/etc/apache2/conf-available/50-server-status.conf]

Parameters differences:

--- File[/etc/apache2/conf-available/50-server-status.conf].orig
+++ File[/etc/apache2/conf-available/50-server-status.conf]

-    mode   => 0444
-    source => puppet:///modules/httpd/status.conf
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[apache2]

Prometheus::Blackbox::Check::Http[PKI_puppet_rsa]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_puppet_rsa].orig
+++ Prometheus::Blackbox::Check::Http[PKI_puppet_rsa]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"puppet_rsa"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Nrpe::Monitor_service[check_certificate_expiry_discovery2026]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_discovery2026].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_discovery2026]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: discovery2026
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

Systemd::Timer[cfssl-ocsprefresh-dse]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-dse].orig
+++ Systemd::Timer[cfssl-ocsprefresh-dse]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-dse.service

File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-puppet_rsa.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/cfssl-ocspserve@puppet_rsa.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@puppet_rsa.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@puppet_rsa.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@puppet_rsa.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@puppet_rsa.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (puppet_rsa)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10008 \
-          -responses /etc/cfssl/ocsp/puppet_rsa.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/ocsp/wikikube_staging.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/wikikube_staging.ocsp].orig
+++ File[/etc/cfssl/ocsp/wikikube_staging.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Nrpe::Check[check_check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_wikikube_staging].orig
+++ Nrpe::Check[check_check_certificate_expiry_wikikube_staging]

-    before    => Monitoring::Service[check_certificate_expiry_wikikube_staging]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem

File[/usr/local/bin/prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-discovery-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-discovery-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service

Systemd::Syslog[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_zuul.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_zuul.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_zuul.prom]

-    owner  => root
-    group  => root
-    ensure => absent

File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.timer (cfssl-ocsprefresh-aux_front_proxy.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-aux_front_proxy.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-aux_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Cfssl::Ocsp[zuul]

Parameters differences:

--- Cfssl::Ocsp[zuul].orig
+++ Cfssl::Ocsp[zuul]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 10009
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/zuul/ca/zuul.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

File[/var/log/cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-aux_front_proxy].orig
+++ File[/var/log/cfssl-ocsprefresh-aux_front_proxy]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/etc/cfssl/signers/cassandra/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/cassandra/cfssl.conf].orig
+++ File[/etc/cfssl/signers/cassandra/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/cassandra/cfssl.conf.orig
+++ /etc/cfssl/signers/cassandra/cfssl.conf
@@ -1,65 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/cassandra",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/cassandra"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Systemd::Service[nrpe2nodexp-check_certificate_expiry_kafka]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_kafka].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_kafka]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Exec[Generate initial CRL for zuul]

Parameters differences:

--- Exec[Generate initial CRL for zuul].orig
+++ Exec[Generate initial CRL for zuul]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/zuul
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/zuul/ca/zuul.pem /etc/cfssl/signers/zuul/ca/zuul-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/zuul

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-zuul-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Logrotate::Conf[cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-aux_front_proxy].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-aux_front_proxy]

-    ensure => present

Cfssl::Config[zuul]

Parameters differences:

--- Cfssl::Config[zuul].orig
+++ Cfssl::Config[zuul]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/zuul
-    default_auth_remote => {}
-    default_usages      => ['server auth', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/zuul/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/zuul

Cfssl::Cert[OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_dse_front_proxy_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => dse_front_proxy
-    notify          => Service[cfssl-ocspserve@dse_front_proxy]
-    profile         => ocsp

Systemd::Unit[cfssl-ocsprefresh-wikikube.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-wikikube.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-cassandra.service (cfssl-ocsprefresh-cassandra.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]
-    ensure   => present
-    priority => 40

Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@aux_front_proxy.service (cfssl-ocspserve@aux_front_proxy)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@aux_front_proxy]']
-    command     => /bin/systemctl daemon-reload

Nrpe::Monitor_service[check_certificate_expiry_discovery]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_discovery].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_discovery]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: discovery
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]']

File[/etc/cfssl/signers/syslog/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/syslog/cfssl.conf].orig
+++ File[/etc/cfssl/signers/syslog/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/syslog/cfssl.conf.orig
+++ /etc/cfssl/signers/syslog/cfssl.conf
@@ -1,65 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/syslog",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/syslog"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

File[/etc/sudoers.d/nrpe_certificate_check_debmonitor]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_debmonitor].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_debmonitor]

-    owner  => root
-    group  => root
-    ensure => absent

File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-wikikube_front_proxy
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-wikikube_front_proxy
-
-/var/log/cfssl-ocsprefresh-wikikube_front_proxy/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-kafka-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-kafka-certificate-expiry --cert-path /etc/cfssl/signers/kafka/ca/kafka.pem --outfile /var/lib/prometheus/node.d/kafka_intermediate.prom

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_etcd.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_etcd]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]
-    ensure   => present
-    priority => 40

Package[links]

Parameters differences:

--- Package[links].orig
+++ Package[links]

-    provider => apt
-    ensure   => installed

File[/srv/cfssl/bundles/mlserve.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/mlserve.pem].orig
+++ File[/srv/cfssl/bundles/mlserve.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/mlserve.pem.orig
+++ /srv/cfssl/bundles/mlserve.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqTCCAwugAwIBAgIUC2E+U3FwNsKpcXq1D5KD3ILh08QwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB1
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRAwDgYDVQQDEwdtbHNlcnZlMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA
-4+yIcr5bDRYOqvzsS95b/CFOM84v7vZlxRXO9paOop7nSpVED1+upVrhfM69F4Rd
-hMDYeRBUiXxZsecByAdWu0AAEWeCZiL+QqMEJeoGML8iobA6rGa+5y2qePBUcV5m
-4u0sePHBq8CYXdIgPHo8bIho/A30Q/IhwEIln0OoSq1ZlcOjggEMMIIBCDAOBgNV
-HQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUYMFEsH4H
-fAVzgmuJIW+M+s7UPVEwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYw
-VgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVy
-eS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRD
-MEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVk
-aWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQUW5mZclFy2C
-6VREX3v/LuAnzguojsBHnRSGXWR1TYoN8aBrtzC0w6KaC+5ka5VCByGmlMDY4GxF
-GLuM8bnvHf4FAkIBva6mukWZ7ZKbNSGakTVG3PeEvZs1b4xkq7+6RYjlv819FjLm
-jPag2y90JiWcyA7gw4IZqc3BgFuT46K+AqsKzhY=
------END CERTIFICATE-----

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Cfssl::Ocsp[mlserve]

Parameters differences:

--- Cfssl::Ocsp[mlserve].orig
+++ Cfssl::Ocsp[mlserve]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 20030
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/mlserve/ca/mlserve.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Systemd::Unit[wmf_auto_restart_apache2.service]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_apache2.service].orig
+++ Systemd::Unit[wmf_auto_restart_apache2.service]

-    override          => False
-    unit              => wmf_auto_restart_apache2.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/cfssl-ocspserve@network_devices.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@network_devices.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@network_devices.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@network_devices.service (cfssl-ocspserve@network_devices)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@network_devices.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@network_devices.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (network_devices)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20063 \
-          -responses /etc/cfssl/ocsp/network_devices.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Service[cfssl-ocspserve@etcd]

Parameters differences:

--- Service[cfssl-ocspserve@etcd].orig
+++ Service[cfssl-ocspserve@etcd]

-    ensure => running
-    enable => True

File[/etc/cfssl/signers/dse/ca/dse-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/dse/ca/dse-key.pem].orig
+++ File[/etc/cfssl/signers/dse/ca/dse-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_wikikube_staging_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging -profile ocsp /etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-wikikube-front-proxy.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-wikikube_front_proxy" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-wikikube_front_proxy/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Prometheus::Alert::Rule[check_check_certificate_expiry_discovery2026_bf2e3510cb63e5f05f545e816bab4edf]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_discovery2026_bf2e3510cb63e5f05f545e816bab4edf].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_discovery2026_bf2e3510cb63e5f05f545e816bab4edf]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_discovery2026))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: discovery2026
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: discovery2026
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="bf2e3510cb63e5f05f545e816bab4edf",check_name="check_check_certificate_expiry_discovery2026", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__discovery2026
-    group              => nrpechecks
-    severity           => info

Systemd::Timer[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service

Exec[Generate initial CRL for dse_front_proxy]

Parameters differences:

--- Exec[Generate initial CRL for dse_front_proxy].orig
+++ Exec[Generate initial CRL for dse_front_proxy]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/dse_front_proxy
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/dse_front_proxy

Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/usr/local/bin/prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-discovery2026-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-discovery2026-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-wikikube_front_proxy.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-wikikube_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Cfssl::Cert[OCSP_debmonitor_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_debmonitor_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_debmonitor_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-debmonitor]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => debmonitor
-    notify          => Service[cfssl-ocspserve@debmonitor]
-    profile         => ocsp

Systemd::Monitor[cfssl-multirootca]

Parameters differences:

--- Systemd::Monitor[cfssl-multirootca].orig
+++ Systemd::Monitor[cfssl-multirootca]

-    migration_task => T350694
-    critical       => True
-    retries        => 2
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI
-    ensure         => present
-    contact_group  => admins
-    check_interval => 10

Systemd::Unit[cfssl-ocspserve@cassandra]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@cassandra].orig
+++ Systemd::Unit[cfssl-ocspserve@cassandra]

-    override          => False
-    unit              => cfssl-ocspserve@cassandra
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_etcd
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem

Cfssl::Ocsp[puppet_rsa]

Parameters differences:

--- Cfssl::Ocsp[puppet_rsa].orig
+++ Cfssl::Ocsp[puppet_rsa]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 10008
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-dse_front_proxy.timer (cfssl-ocsprefresh-dse_front_proxy.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-dse_front_proxy.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-dse_front_proxy.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-dse_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-discovery.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-discovery.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-discovery.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-discovery.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-discovery.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Service[cfssl-multirootca]

Parameters differences:

--- Service[cfssl-multirootca].orig
+++ Service[cfssl-multirootca]

-    ensure => running
-    enable => True

Service[cfssl-ocspserve@dse_front_proxy]

Parameters differences:

--- Service[cfssl-ocspserve@dse_front_proxy].orig
+++ Service[cfssl-ocspserve@dse_front_proxy]

-    ensure => running
-    enable => True

File[/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf].orig
+++ File[/etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf.orig
+++ /etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "72h",
-      "crl_url": "http://pki.discovery.wmnet/crl/wikikube_staging_front_proxy",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/wikikube_staging_front_proxy"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Monitoring::Service[check_certificate_expiry_etcd]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_etcd].orig
+++ Monitoring::Service[check_certificate_expiry_etcd]

-    check_command  => nrpe_check!check_check_certificate_expiry_etcd!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: etcd
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

Logrotate::Conf[cfssl-ocsprefresh-dse]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-dse].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-dse]

-    ensure => present

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_wikikube_staging.service

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Systemd::Service[cfssl-ocsprefresh-etcd]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-etcd].orig
+++ Systemd::Service[cfssl-ocsprefresh-etcd]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-etcd.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/etc/cfssl/signers/discovery2026/ca/discovery2026.pem]

Parameters differences:

--- File[/etc/cfssl/signers/discovery2026/ca/discovery2026.pem].orig
+++ File[/etc/cfssl/signers/discovery2026/ca/discovery2026.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/discovery2026/ca/discovery2026.pem.orig
+++ /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrzCCAxGgAwIBAgIUa46nWae1FhV+WZzdsRMJchzTP54wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjYwNDIwMTUzNjAwWhcNMzEwNDE5MTUzNjAwWjB7
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRYwFAYDVQQDEw1kaXNjb3ZlcnkyMDI2MIGbMBAGByqGSM49AgEGBSuBBAAj
-A4GGAAQBNeE+xxvbq00KO92aWhHFTLosZBkXul9ufZINtOUd90TXpQnJvpEv7kK8
-HQpufac9Dez+MBhLzQXoTY+ElhRCsQQBwlu+rIeqpbJEh87DQ2RTfzhTJmlm/9de
-1fiM38/51DacwYS/vW0psN/lKSoM7cX/Paw6Qg7pBUmUGCq2vE9wDbmjggEMMIIB
-CDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU
-SXZcMeXrgnEYbZ3z1m8j/+8XmugwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR
-0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRp
-c2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoG
-A1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9X
-aWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQgD4
-UGn506FGvacDvYS6t8JEMo6YH7jxK8dKeiZNEnhG5FSjA4Lt2BCz85sOBczxSD9h
-b9wLCxy5wOpifRePlyrZQgJBNKUXBImWpyoHmt6hNOA6X7+FmGl0tD5tLnbeuPx7
-aTlv8rfJ0d7JdsZXx+7M6YcsmxMgZCKUh4UMYu/WcczIq30=
------END CERTIFICATE-----

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_front_proxy_e515778a769f523fb98a7f642670e011]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_front_proxy_e515778a769f523fb98a7f642670e011].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_staging_front_proxy_e515778a769f523fb98a7f642670e011]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_wikikube_staging_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="e515778a769f523fb98a7f642670e011",check_name="check_check_certificate_expiry_wikikube_staging_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__wikikube_staging_front_proxy
-    group              => nrpechecks
-    severity           => info

File[/lib/systemd/system/cfssl-ocsprefresh-kafka.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-kafka.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-kafka.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-kafka.timer (cfssl-ocsprefresh-kafka.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-kafka.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-kafka.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-kafka.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-kafka.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_staging_front_proxy command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "e515778a769f523fb98a7f642670e011" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_staging_front_proxy"

File[/etc/cfssl/signers/wikikube/ca/wikikube-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube/ca/wikikube-key.pem].orig
+++ File[/etc/cfssl/signers/wikikube/ca/wikikube-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/wikikube/ca/wikikube-key.pem.orig
+++ /etc/cfssl/signers/wikikube/ca/wikikube-key.pem
@@ -1 +0,0 @@
-test

Service[cfssl-ocsprefresh-network_devices.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-network_devices.timer].orig
+++ Service[cfssl-ocsprefresh-network_devices.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/etc/cfssl/signers/puppet_rsa/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/puppet_rsa/cfssl.conf].orig
+++ File[/etc/cfssl/signers/puppet_rsa/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/puppet_rsa/cfssl.conf.orig
+++ /etc/cfssl/signers/puppet_rsa/cfssl.conf
@@ -1,73 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/puppet_rsa",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/puppet_rsa"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "mtls": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-syslog.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-syslog" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-syslog/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/apache2/conf-enabled/50-server-status.conf]

Parameters differences:

--- File[/etc/apache2/conf-enabled/50-server-status.conf].orig
+++ File[/etc/apache2/conf-enabled/50-server-status.conf]

-    target => /etc/apache2/conf-available/50-server-status.conf
-    ensure => link
-    owner  => root
-    group  => root
-    notify => Service[apache2]

File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    ensure => present

File[/etc/cfssl/signers/discovery/ca/discovery.pem]

Parameters differences:

--- File[/etc/cfssl/signers/discovery/ca/discovery.pem].orig
+++ File[/etc/cfssl/signers/discovery/ca/discovery.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/discovery/ca/discovery.pem.orig
+++ /etc/cfssl/signers/discovery/ca/discovery.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrDCCAw2gAwIBAgIUcVMxEVtp5xErDjx/jInOFcUaRjkwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjEwNTA0MTM1NDAwWhcNMjYwNTAzMTM1NDAwWjB3
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRIwEAYDVQQDEwlkaXNjb3ZlcnkwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
-BAG7X6lQ05D8EQYwPd+v2qT12Y35j/YQTaOEbAuKQJBshTdMizCxGe4GUB33Nivw
-3B0o9EcyCQokcUCUGtVlI3U0QQArB+LuehDTw7D5JKwOUK5GpSG5YlNL7Kg2c3gI
-wyck1+Z5yDMIsclW5FtaM1IIFeUIOXrulmih3zM4PPrVtP3Vh6OCAQwwggEIMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSJ76Rw
-5IjvCdxrdGkh4PHUL7PCBjAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
-NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
-ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
-BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
-ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCAeamwKAw
-q+lKC/GdcPuP2SOoyij0+LFWucrQwxxiCiXlMAhSnj3fkKk5G5pLoFnY2X7hB0w4
-ZPtLXG7If9pmIDjwAkIBwnJUYLz3dJTbZudeUJFX4yD49liKTYMPDpl/HWKSh9m4
-4PZKXsAIs4CT29jwwtmsLK1HkPB0ShO8Egm/KB5dLUs=
------END CERTIFICATE-----

File[/srv/cfssl/bundles/mlserve_staging_front_proxy.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/mlserve_staging_front_proxy.pem].orig
+++ File[/srv/cfssl/bundles/mlserve_staging_front_proxy.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/mlserve_staging_front_proxy.pem.orig
+++ /srv/cfssl/bundles/mlserve_staging_front_proxy.pem
@@ -1,23 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDvjCCAyCgAwIBAgIUV8ha2UdjViI49Xr/fZzbY4YPZdYwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
-iTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczEkMCIGA1UEAwwbbWxzZXJ2ZV9zdGFnaW5nX2Zyb250X3Byb3h5MIGbMBAG
-ByqGSM49AgEGBSuBBAAjA4GGAAQAyrMiWBRjOWCaMXsvXC0wS6VzHyLLGFT8BpM9
-EhYcloDfNnb8no2+YXrBzj4+lAg3D3dq53q+hyHko3+YsVVF/qABa55syWkYtxDB
-xy5FNq6Iq/s2E3vO2YpQifWXlaSZvvuZCGhhTPDOp/zdI/kKdco9Jehsu6CdyElj
-lCgJTZupZCmjggEMMIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB
-/wIBATAdBgNVHQ4EFgQUj5l8xt65hr4t5yj8xKYmUsKwk9YwHwYDVR0jBBgwFoAU
-O62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzAB
-hjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRl
-cm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292
-ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjO
-PQQDBAOBiwAwgYcCQgD24XA2cP2pFwE3onWEosbFqDEaFwD5kNg7eSOkncJIceFU
-bCX1f6VOYSv6UbiEQV0EwS0d34EawydbLcqXqfHgpgJBJJjdNhpjAcwyRt1+unRc
-dYn6ys1ZElRXMld7NUq+nCInX5cVk8uPeSev6IxIJc2eyBCb4jtjvE3TAQ2RHvT9
-sBI=
------END CERTIFICATE-----

Systemd::Timer::Job[cfssl-ocsprefresh-kafka]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-kafka].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-kafka]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - kafka
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/kafka/ca/kafka.pem --responses-file /etc/cfssl/ocsp/kafka.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@kafka' kafka

Systemd::Unit[cfssl-ocsprefresh-network_devices.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-network_devices.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-network_devices.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-network_devices.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer)]']

Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - Wikimedia_Internal_Root_CA
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem --responses-file /etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@Wikimedia_Internal_Root_CA' Wikimedia_Internal_Root_CA

Profile::Pki::Multirootca::Monitoring[cassandra]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[cassandra].orig
+++ Profile::Pki::Multirootca::Monitoring[cassandra]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/cassandra/ca/cassandra.pem
-    intermediate => cassandra

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.timer (cfssl-ocsprefresh-wikikube_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-wikikube_front_proxy.timer]']

Class[Profile::Cumin::Target]

Parameters differences:

--- Class[Profile::Cumin::Target].orig
+++ Class[Profile::Cumin::Target]

@@
-    cluster => pki
+    cluster => insetup

Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Cfssl::Config[wikikube_staging]

Parameters differences:

--- Cfssl::Config[wikikube_staging].orig
+++ Cfssl::Config[wikikube_staging]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/wikikube_staging
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/wikikube_staging/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment', 'server auth']}, 'service-account-management': {'expiry': '72h', 'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    default_expiry      => 72h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/wikikube_staging

File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.timer (cfssl-ocsprefresh-puppet_rsa.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-puppet_rsa.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-puppet_rsa.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-puppet_rsa.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Service[cfssl-ocspserve@mlserve_staging]

Parameters differences:

--- Service[cfssl-ocspserve@mlserve_staging].orig
+++ Service[cfssl-ocspserve@mlserve_staging]

-    ensure => running
-    enable => True

File[/etc/cfssl/signers/aux/ca/aux-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/aux/ca/aux-key.pem].orig
+++ File[/etc/cfssl/signers/aux/ca/aux-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/aux/ca/aux-key.pem.orig
+++ /etc/cfssl/signers/aux/ca/aux-key.pem
@@ -1 +0,0 @@
-nosecret

Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_etcd_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label etcd -profile ocsp /etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_mlserve.service

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_front_proxy.service (cfssl-ocspserve@wikikube_front_proxy)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@wikikube_front_proxy.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (wikikube_front_proxy)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20011 \
-          -responses /etc/cfssl/ocsp/wikikube_front_proxy.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Class[Puppet::Agent]

Parameters differences:

--- Class[Puppet::Agent].orig
+++ Class[Puppet::Agent]

@@
-    dns_alt_names => ['pki.discovery.wmnet']
+    dns_alt_names => []

Cfssl::Config[network_devices]

Parameters differences:

--- Cfssl::Config[network_devices].orig
+++ Cfssl::Config[network_devices]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/network_devices
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/network_devices/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_expiry      => 8760h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/network_devices

Prometheus::Blackbox::Check::Http[PKI_mlserve_front_proxy]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_mlserve_front_proxy].orig
+++ Prometheus::Blackbox::Check::Http[PKI_mlserve_front_proxy]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"mlserve_front_proxy"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Exec[renew certificate - OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet

Nrpe::Monitor_service[check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_cloud_wmnet_ca].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_cloud_wmnet_ca]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

File[/etc/cfssl/ocsp/wikikube_front_proxy.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/wikikube_front_proxy.ocsp].orig
+++ File[/etc/cfssl/ocsp/wikikube_front_proxy.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

File[/srv/cfssl/bundles/wikikube_front_proxy.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/wikikube_front_proxy.pem].orig
+++ File[/srv/cfssl/bundles/wikikube_front_proxy.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/wikikube_front_proxy.pem.orig
+++ /srv/cfssl/bundles/wikikube_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDuDCCAxmgAwIBAgIUCqmj+2MwaOqLPb5TPXkbkF/PGkUwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
-gjELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczEdMBsGA1UEAwwUd2lraWt1YmVfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0C
-AQYFK4EEACMDgYYABAAUuXSlLM/Sq6jmsr6/+aqYnBNDoelW5+uJ8kWFyR/9xaFf
-hmvvui358ZLmOym6cA1tpoA1+PVZ1sVOE++GDsWQ3QDAG2kk8o0QxpXsCXLWBmJZ
-92Z/pIO7Fc65qe6XDnuZLEaqbb6VWkqQPI15cL9AhJ8HgNbaoaxrT51MfCrHEteP
-raOCAQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0G
-A1UdDgQWBBTlGjpQ7L1N14lCjcKcI/4LLNraBjAfBgNVHSMEGDAWgBQ7raJx5jS9
-G/yAvzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6
-Ly9wa2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jv
-b3RfQ0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21u
-ZXQvY3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GM
-ADCBiAJCAYT0XLJdjumemn8jpqv058zb+c+3zb+05EhNcj15wcjRUq8SU+c2+H8a
-hzfph97+CVSvGaV6Cf7phTSEBDPk9+T4AkIBdOmzIcRH+K9UcDzvdxqerOiXJaBC
-0Bgbg9dOhcd6d0j3CObOuIp760FFQLSli2ocG3WLkfNsXlL1/3+VL+yarNo=
------END CERTIFICATE-----

File[/etc/logrotate.d/cfssl-ocsprefresh-kafka]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-kafka].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-kafka]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-kafka.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-kafka
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-kafka
-
-/var/log/cfssl-ocsprefresh-kafka/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change].orig
+++ Exec[Generate cert puppet_rsa__pki_discovery_wmnet refresh on intermediate ca change]

-    subscribe   => File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]
-    refreshonly => True
-    require     => Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
-    environment => ['GODEBUG=x509ignoreCN=0']
-    notify      => ['Service[apache2]']
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa  /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_kafka.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-gc-expired-certs.timer (cfssl-gc-expired-certs.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-gc-expired-certs.timer]']

File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/sudoers.d/nrpe_certificate_check_syslog]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_syslog].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_syslog]

-    owner  => root
-    group  => root
-    ensure => absent

Systemd::Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Cfssl::Config[aux]

Parameters differences:

--- Cfssl::Config[aux].orig
+++ Cfssl::Config[aux]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/aux
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/aux/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/aux

File[/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-cloud-wmnet-ca.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-cloud_wmnet_ca" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-cloud_wmnet_ca/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Timer[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.timer]']

File[/lib/systemd/system/cfssl-ocsprefresh-zuul.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-zuul.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-zuul.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.service (cfssl-ocsprefresh-zuul.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-zuul.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-zuul.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - zuul
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/zuul/ca/zuul.pem --responses-file /etc/cfssl/ocsp/zuul.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@zuul' zuul

Service[cfssl-ocsprefresh-zuul.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-zuul.timer].orig
+++ Service[cfssl-ocsprefresh-zuul.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_syslog]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_syslog].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_syslog]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_syslog command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_syslog
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "e3b9b989d5062ce2d267023dfe42fcd8" --timeout 10 --check-command "check_check_certificate_expiry_syslog"

File[/etc/ferm/conf.d/10_multirootca_tls_termination]

Parameters differences:

--- File[/etc/ferm/conf.d/10_multirootca_tls_termination].orig
+++ File[/etc/ferm/conf.d/10_multirootca_tls_termination]

-    mode    => 0400
-    require => File[/etc/ferm/conf.d]
-    tag     => ferm
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[ferm]

Content differences:

--- /etc/ferm/conf.d/10_multirootca_tls_termination.orig
+++ /etc/ferm/conf.d/10_multirootca_tls_termination
@@ -1,6 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 
-&R_SERVICE(tcp, 443, $DOMAIN_NETWORKS);
-
-

File[/etc/sudoers.d/nrpe_certificate_check_cloud_wmnet_ca]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_cloud_wmnet_ca].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_cloud_wmnet_ca]

-    owner  => root
-    group  => root
-    ensure => absent

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - mlserve_staging_front_proxy
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --responses-file /etc/cfssl/ocsp/mlserve_staging_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve_staging_front_proxy' mlserve_staging_front_proxy

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_front_proxy command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "4d759acaf0fd7dd3abaa03dc4565aef6" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_front_proxy"

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_mlserve.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_mlserve.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/var/log/cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-dse_front_proxy].orig
+++ File[/var/log/cfssl-ocsprefresh-dse_front_proxy]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Systemd::Unit[cfssl-ocsprefresh-cassandra.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-cassandra.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-cassandra.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-cassandra.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Sudo::User[nrpe-check_check_cfssl-multirootca_status]

Parameters differences:

--- Sudo::User[nrpe-check_check_cfssl-multirootca_status].orig
+++ Sudo::User[nrpe-check_check_cfssl-multirootca_status]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => absent
-    privileges => []
-    user       => nagios

Cfssl::Ocsp[wikikube_front_proxy]

Parameters differences:

--- Cfssl::Ocsp[wikikube_front_proxy].orig
+++ Cfssl::Ocsp[wikikube_front_proxy]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 20011
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

File[/etc/cfssl/signers/zuul/ca]

Parameters differences:

--- File[/etc/cfssl/signers/zuul/ca].orig
+++ File[/etc/cfssl/signers/zuul/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-aux_front_proxy.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - aux_front_proxy
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --responses-file /etc/cfssl/ocsp/aux_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@aux_front_proxy' aux_front_proxy

Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - mlserve
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve/ca/mlserve.pem --responses-file /etc/cfssl/ocsp/mlserve.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve' mlserve

File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem]

Parameters differences:

--- File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem].orig
+++ File[/etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem.orig
+++ /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrzCCAxKgAwIBAgIURAaLNJ85iLqv3Tqt4ylu7Dhe0o0wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjExMjEzMTg1NTAwWhcNMjYxMjEyMTg1NTAwWjB8
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRcwFQYDVQQDDA5jbG91ZF93bW5ldF9jYTCBmzAQBgcqhkjOPQIBBgUrgQQA
-IwOBhgAEAFsH4mfZKGu87WTpX9yabGE0+vO4UBQaN/IUGnjmscZTZ7761iAwuZcs
-33yjwzoX2W+R0IwAPJbagtB92uYPmA6eAUDV4WAuOml+AqAP0elVtW7i+T/Bm4qc
-SrlGCDsALgJ765YZCDS9OmzAm9rXbQXFmsxqrm9I3aPXIOWIww5+Zg1mo4IBDDCC
-AQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
-FMavCWJlEuGLgOx5zgBdQCQ0Zxj7MB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGD
-kdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5k
-aXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBK
-BgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwv
-V2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYoAMIGGAkEQ
-XFKpUB99oxOp7uK3GztZblTr8DECjcwbJOXYfZLGyfzzNIKPMGPkBGNmGkP7Ie1G
-RSCNRsI1VR8/geUR0YUrpwJBRZWF4DZM3cga+6VB7pEv/7r/pQERs/ivzckNwDLi
-/LK1pbHc/MeNOdoy7TouLf1djsw40VYtGNT7/9FldHoWqsA=
------END CERTIFICATE-----

File[/etc/cfssl/signers/cloud_wmnet_ca/ca]

Parameters differences:

--- File[/etc/cfssl/signers/cloud_wmnet_ca/ca].orig
+++ File[/etc/cfssl/signers/cloud_wmnet_ca/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/etc/cfssl/signers/etcd/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/etcd/cfssl.conf].orig
+++ File[/etc/cfssl/signers/etcd/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/etcd/cfssl.conf.orig
+++ /etc/cfssl/signers/etcd/cfssl.conf
@@ -1,65 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/etcd",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/etcd"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

File[/etc/cfssl/ocsp/wikikube.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/wikikube.ocsp].orig
+++ File[/etc/cfssl/ocsp/wikikube.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]']

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.timer]']

Nrpe::Check[check_check_certificate_expiry_wikikube]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_wikikube].orig
+++ Nrpe::Check[check_check_certificate_expiry_wikikube]

-    before    => Monitoring::Service[check_certificate_expiry_wikikube]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem

File[/etc/logrotate.d/cfssl-ocsprefresh-discovery]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-discovery].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-discovery]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-discovery.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-discovery
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-discovery
-
-/var/log/cfssl-ocsprefresh-discovery/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[cfssl-ocsprefresh-kafka.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-kafka.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-kafka.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-kafka.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_network_devices_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label network_devices -profile ocsp /etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet

Exec[ensure_present_mod_proxy_http]

Parameters differences:

--- Exec[ensure_present_mod_proxy_http].orig
+++ Exec[ensure_present_mod_proxy_http]

-    require => Package[apache2]
-    creates => /etc/apache2/mods-enabled/proxy_http.load
-    notify  => Service[apache2]
-    command => /usr/sbin/a2enmod proxy_http

Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-mlserve_staging_front_proxy.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_debmonitor.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/etc/sudoers.d/nrpe_certificate_check_cassandra]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_cassandra].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_cassandra]

-    owner  => root
-    group  => root
-    ensure => absent

Systemd::Timer[cfssl-ocsprefresh-network_devices]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-network_devices].orig
+++ Systemd::Timer[cfssl-ocsprefresh-network_devices]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-network_devices.service

Service[cfssl-ocsprefresh-discovery.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-discovery.timer].orig
+++ Service[cfssl-ocsprefresh-discovery.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/etc/cfssl/signers/etcd]

Parameters differences:

--- File[/etc/cfssl/signers/etcd].orig
+++ File[/etc/cfssl/signers/etcd]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_mlserve_staging_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_staging -profile ocsp /etc/cfssl/csr/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet

File[/etc/cfssl/ocsp/puppet_rsa.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/puppet_rsa.ocsp].orig
+++ File[/etc/cfssl/ocsp/puppet_rsa.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_network_devices_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_aux]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_aux.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_aux
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Cfssl::Ocsp[cassandra]

Parameters differences:

--- Cfssl::Ocsp[cassandra].orig
+++ Cfssl::Ocsp[cassandra]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 10006
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/cassandra/ca/cassandra.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

File[/etc/sudoers.d/nrpe_certificate_check_kafka]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_kafka].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_kafka]

-    owner  => root
-    group  => root
-    ensure => absent

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]
-    ensure   => present
-    priority => 40

Logrotate::Conf[cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-discovery2026].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-discovery2026]

-    ensure => present

File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-staging-front-proxy-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux_front_proxy].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Sudo::User[nrpe-check_check_certificate_expiry_wikikube]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_wikikube].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_wikikube]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem']
-    user       => nagios

Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux -profile ocsp /etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_wikikube_staging.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[cfssl-ocsprefresh-discovery.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-discovery.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-discovery.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-discovery.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Nrpe::Check[check_check_certificate_expiry_discovery]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_discovery].orig
+++ Nrpe::Check[check_check_certificate_expiry_discovery]

-    before    => Monitoring::Service[check_certificate_expiry_discovery]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem

Logrotate::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    ensure => present

Systemd::Unit[cfssl-ocsprefresh-network_devices.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-network_devices.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-network_devices.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-network_devices.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem].orig
+++ File[/etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem.orig
+++ /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem
@@ -1 +0,0 @@
-nosecret

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.timer (nrpe2nodexp-check_certificate_expiry_aux.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Prometheus::Alert::Rule[check_check_certificate_expiry_etcd_c834f873297e445663ead81279c0b928]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_etcd_c834f873297e445663ead81279c0b928].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_etcd_c834f873297e445663ead81279c0b928]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_etcd))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: etcd
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: etcd
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="c834f873297e445663ead81279c0b928",check_name="check_check_certificate_expiry_etcd", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__etcd
-    group              => nrpechecks
-    severity           => info

Cfssl::Ocsp[mlserve_front_proxy]

Parameters differences:

--- Cfssl::Ocsp[mlserve_front_proxy].orig
+++ Cfssl::Ocsp[mlserve_front_proxy]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 20031
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[wmf_auto_restart_apache-htcacheclean.timer]

Parameters differences:

--- Service[wmf_auto_restart_apache-htcacheclean.timer].orig
+++ Service[wmf_auto_restart_apache-htcacheclean.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]']

Systemd::Timer::Job[cfssl-gc-expired-certs]

Parameters differences:

--- Systemd::Timer::Job[cfssl-gc-expired-certs].orig
+++ Systemd::Timer::Job[cfssl-gc-expired-certs]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Delete expired Certificates from the cfssl DB
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': 'hourly'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-certs clean

Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery.timer (cfssl-ocsprefresh-discovery.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-discovery.timer]']

Monitoring::Service[check_certificate_expiry_zuul]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_zuul].orig
+++ Monitoring::Service[check_certificate_expiry_zuul]

-    check_command  => nrpe_check!check_check_certificate_expiry_zuul!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: zuul
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

Prometheus::Blackbox::Check::Http[PKI_mlserve_staging]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_mlserve_staging].orig
+++ Prometheus::Blackbox::Check::Http[PKI_mlserve_staging]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"mlserve_staging"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_puppet_rsa.service (nrpe2nodexp-check_certificate_expiry_puppet_rsa.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.timer (cfssl-ocsprefresh-discovery2026.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-discovery2026.timer]']

Prometheus::Blackbox::Check::Http[PKI_discovery]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_discovery].orig
+++ Prometheus::Blackbox::Check::Http[PKI_discovery]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"discovery"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Systemd::Timer::Job[cfssl-ocsprefresh-mlserve]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-mlserve].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-mlserve]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - mlserve
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/mlserve/ca/mlserve.pem --responses-file /etc/cfssl/ocsp/mlserve.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@mlserve' mlserve

Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/logrotate.d/cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-discovery2026].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-discovery2026]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-discovery2026.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-discovery2026
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-discovery2026
-
-/var/log/cfssl-ocsprefresh-discovery2026/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Timer[cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-wikikube_staging].orig
+++ Systemd::Timer[cfssl-ocsprefresh-wikikube_staging]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-wikikube_staging.service

File[/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf].orig
+++ File[/etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf.orig
+++ /etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "72h",
-      "crl_url": "http://pki.discovery.wmnet/crl/mlserve_staging_front_proxy",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/mlserve_staging_front_proxy"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-kafka.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-kafka" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-kafka/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/signers/wikikube_front_proxy/ca]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_front_proxy/ca].orig
+++ File[/etc/cfssl/signers/wikikube_front_proxy/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@debmonitor.service (cfssl-ocspserve@debmonitor)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@debmonitor]']
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/cfssl-ocsprefresh-syslog.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-syslog.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-syslog.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-syslog.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-syslog.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - syslog
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/syslog/ca/syslog.pem --responses-file /etc/cfssl/ocsp/syslog.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@syslog' syslog

Class[Profile::Base::Production]

Parameters differences:

--- Class[Profile::Base::Production].orig
+++ Class[Profile::Base::Production]

@@
-    role_description => PKI server
+    role_description => Host being setup by Infrastructure Foundations SREs with ferm

Systemd::Unit[wmf_auto_restart_apache2.timer]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_apache2.timer].orig
+++ Systemd::Unit[wmf_auto_restart_apache2.timer]

-    override          => False
-    unit              => wmf_auto_restart_apache2.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Service[nrpe2nodexp-check_certificate_expiry_wikikube.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_wikikube.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_wikikube.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]']

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-discovery-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_zuul.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_zuul.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/srv/cfssl/bundles/mlserve_staging.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/mlserve_staging.pem].orig
+++ File[/srv/cfssl/bundles/mlserve_staging.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/mlserve_staging.pem.orig
+++ /srv/cfssl/bundles/mlserve_staging.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUHWrqd3I2VME7z6A5M3brKa5UlOgwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9tbHNlcnZlX3N0YWdpbmcwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABAAu0g2dBBEAH2iUfZLPv+mA+1srb6S3bdVyH/kRk+QZDoOMnM0H8Edn
-V+dakFKXnwl+w+qsOsWj1NP2FlOm3bTglwCIxFAzX5XaDfqWa74L1tIqDH6kx+bX
-yxnuGWT/U1cv8rIHFap7ccH3h5YxPQfHy73KRTWxPln6ByswgxekotwnCKOCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBSRzdapYuh57Gp5MstVlUJNJ+6zTzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-AY8VuLFo6MpcfxrDG8Junk8mESfQTMRbfeZM6WpHqKYBTESkpeV8HIdTYliFDAMX
-JqE94+xbPVaTS8DZ0xiXz4SjAkIBEIIXA4nOdLYbX/MvdKWr7aDunH8n1oO3K/op
-7NktfJd5CXuECxdSonHOb7PFW5lbpCtZrLxFzhB2Hlp1TBWHX84=
------END CERTIFICATE-----

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

File[/lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@dse_front_proxy.service (cfssl-ocspserve@dse_front_proxy)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@dse_front_proxy.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (dse_front_proxy)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20062 \
-          -responses /etc/cfssl/ocsp/dse_front_proxy.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/cfssl/ocsp/discovery2026.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/discovery2026.ocsp].orig
+++ File[/etc/cfssl/ocsp/discovery2026.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_front_proxy command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "9d6dd05c8e5e1bb294462d932b24bd1a" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_front_proxy"

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Sudo::User[nrpe_certificate_check_mlserve_staging]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_mlserve_staging].orig
+++ Sudo::User[nrpe_certificate_check_mlserve_staging]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_mlserve_staging

Cfssl::Signer[aux]

Parameters differences:

--- Cfssl::Signer[aux].orig
+++ Cfssl::Signer[aux]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDpjCCAwegAwIBAgIUB83dKT9lbMGOLf38Jx6fmsSa714wCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjBx
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMQwwCgYDVQQDEwNhdXgwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABADhzJSO
h264ltJ1CVADYcfi1rIxQOY3gtAsxonZ6CWNueKg0vjvDeL32l+NZ3f2yj2CIzl5
sa6sZjXmwAKziuuvCAHmsZDY5gzgBdwhZ6UeGAbwlLMgQajwRvCA2RUMuH8iAd6o
QcfZyHQFb0zl9mCHYNkjLT4jpwrL4Lx/DGbmkE/ulqOCAQwwggEIMA4GA1UdDwEB
/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSPVQ8kSyOIH5l4
1mVGCudJoaowtTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCALJuWafVNInsE4Q8
tEHYHqhweF6bEArm7d3dqqTjKHuOcrmhXo4rgX5VsXHtI3qq9XGHoik6JUSwgftV
Sr+GWrIZAkIAuqmJ5vv2LgFcJWvYDkIPH9HXB9rIwAUHPFJ/iX2Ig9By+ss8nJbU
A3Ml/4NKRsXZwwyScmowVWQHfMpv53BsBv8=
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/aux
-    db_host          => localhost
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => nosecret

-    ca_file          => /etc/cfssl/signers/aux/ca/aux.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    ca_key_file      => /etc/cfssl/signers/aux/ca/aux-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/aux
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.service (cfssl-ocsprefresh-mlserve_staging.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[cfssl-ocsprefresh-syslog.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-syslog.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-syslog.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-syslog.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-syslog-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-syslog-certificate-expiry --cert-path /etc/cfssl/signers/syslog/ca/syslog.pem --outfile /var/lib/prometheus/node.d/syslog_intermediate.prom

File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Nrpe::Check[check_check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_dse_front_proxy].orig
+++ Nrpe::Check[check_check_certificate_expiry_dse_front_proxy]

-    before    => Monitoring::Service[check_certificate_expiry_dse_front_proxy]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube_staging_front_proxy command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "e515778a769f523fb98a7f642670e011" --timeout 10 --check-command "check_check_certificate_expiry_wikikube_staging_front_proxy"

File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem]

-    mode   => 0444
-    before => Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
-    owner  => root
-    group  => root
-    notify => Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

Content differences:

--- /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem.orig
+++ /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDmzCCAvygAwIBAgIUN3uLiKCNVwnGG5H9qKGwTGT4fJowCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjEwMzI1MTQ1MTAwWhcNMjYwMzI0MTQ1MTAwWjCB
-mTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxFzAVBgNVBAsTDkNsb3VkIFNlcnZp
-Y2VzMTUwMwYDVQQDDCxXaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQV9vY3NwX3Np
-Z25pbmdfY2VydDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLmGOcHNNTGsOVTG
-17o/lTVCgVJqX751quqBZvJQUbAgfAv0PRgv6yjWzTmZnojzKHYRaV8NXhDIVBzo
-l2DRWUOjggEbMIIBFzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUH
-AwkwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQULRRzzcjqWQc2Fjci5s2v0FKSPJww
-HwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBI
-MEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dp
-a2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6
-Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
-dF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgCI41DoiQFxqs9gDCZs4VhwcNeatHqe
-98IqBIzFOMdZdkUnyTNiXf0VDkUYZ+n2mYmB5ZAaBTPYhTHgLNrc3KsmpQJCAfHM
-Qr3AEz1MlZq2krL+7Mx9OuBQ3B/hXyC+met7EmKDziU8UyScxFfSIY1lwwgAmZHA
-OEOWpgzuF4fGZFVf0dFi
------END CERTIFICATE-----

File[/etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-cloud_wmnet_ca
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-cloud_wmnet_ca
-
-/var/log/cfssl-ocsprefresh-cloud_wmnet_ca/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Cfssl::Ocsp[aux]

Parameters differences:

--- Cfssl::Ocsp[aux].orig
+++ Cfssl::Ocsp[aux]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 20050
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/aux/ca/aux.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

Systemd::Syslog[cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-cloud_wmnet_ca]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - wikikube_staging_front_proxy
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --responses-file /etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_staging_front_proxy' wikikube_staging_front_proxy

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging_front_proxy]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem']
-    user       => nagios

Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-discovery2026.service (cfssl-ocsprefresh-discovery2026.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/srv/cfssl/bundles/etcd.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/etcd.pem].orig
+++ File[/srv/cfssl/bundles/etcd.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/etcd.pem.orig
+++ /srv/cfssl/bundles/etcd.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpzCCAwigAwIBAgIUOk3cFWirYBfYaO6q8zyqfEHxwVEwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIwODEwMTAzODAwWhcNMjcwODA5MTAzODAwWjBy
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ0wCwYDVQQDEwRldGNkMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAgtdp
-7nZHIAQhEm2IlJ7AzfGjWIGGzKzCfnBQ8d+euPiOZ3ccv1YXfx0f+WmV35vuEmA/
-ZSw/6iJrKBnYsZAR6U0ByUUqg6nUYg4P47Sc/kMTWmVIgRuNhmrgavCK+qRQdnZs
-N/OOGTgFNG0icty63dUF4NZz80HxHSrPQYaNxZ9ydY2jggEMMIIBCDAOBgNVHQ8B
-Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUtvZYHyYnZHZP
-ZLIB5kqPcVOVI9owHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
-KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
-bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
-P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
-SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgEgYyeOREniK9JC
-4hvIiuv9D7mVVXzX5/s8GuhTbRadqZr41ulpHT53lFcbt+xhAsyqMxXPhgT/OyMQ
-jkXuEh5oBQJCAM22xLZpt2XwKCp0opgXlC5fm5+YjKba2COlr43q78I2la57aYdp
-UF7sFgBRFVx7FNY7CASuZMYsW+4wltPTXVau
------END CERTIFICATE-----

Rsyslog::Conf[cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-mlserve_front_proxy]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-mlserve_front_proxy]
-    ensure   => present
-    priority => 40

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]']

Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-syslog.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_syslog" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service (nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_debmonitor]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_debmonitor].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_debmonitor]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_debmonitor command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_debmonitor
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "224e2ac3574a9ce482218106d95a2931" --timeout 10 --check-command "check_check_certificate_expiry_debmonitor"

Systemd::Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Nrpe::Monitor_service[check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_mlserve_front_proxy].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_mlserve_front_proxy]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: mlserve_front_proxy
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_zuul]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_zuul].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_zuul]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_zuul command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_zuul
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "373325faaa689f3e9b058d91d4eb6cdb" --timeout 10 --check-command "check_check_certificate_expiry_zuul"

Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@puppet_rsa.service (cfssl-ocspserve@puppet_rsa)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@puppet_rsa]']
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/mlserve_front_proxy]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_front_proxy].orig
+++ File[/etc/cfssl/signers/mlserve_front_proxy]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/lib/systemd/system/cfssl-ocspserve@zuul.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@zuul.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@zuul.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@zuul.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@zuul.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (zuul)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10009 \
-          -responses /etc/cfssl/ocsp/zuul.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

File[/srv/cfssl/bundles/aux_front_proxy.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/aux_front_proxy.pem].orig
+++ File[/srv/cfssl/bundles/aux_front_proxy.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/aux_front_proxy.pem.orig
+++ /srv/cfssl/bundles/aux_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUcL3aZt8/kOKuFw8g90SCOk9VZSYwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9hdXhfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABAFQamNeMXOM8jZDTMiL/0Cgk641Tps3tMBQ6f1OD7fqLh7JGWZXSWIE
-9v25H6dgcqSIWAlvBkbHQUPU51GmXigXtwCW1bYWFZc+MTjXFo2LBUJVUIxh2mh3
-pNZYlgVZXP7a0l3zt2u5vegKRuJ6l0ELtjCJjo/TNYo/BA28XrzCL45HO6OCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBQv7ovDzaQTat1sfWJFkZ+n8+aGSTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-AZ7oTip5kp2Yt9BABNEqYi6GjwpXZvmZOgd6So8UA76jP8duYicuOoNvpoHdEy58
-ZOGpo0lqqIzB8xQcvzvmX7uiAkIAxHVKylOLCoPsUXaZVfUGhNavXXwrbIHTQXDo
-HEHmc9lIMh9hO5z4vPMEbMkSRuAskcT1K/ydEqp4xI191jnovUg=
------END CERTIFICATE-----

File[/var/log/cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-wikikube_staging].orig
+++ File[/var/log/cfssl-ocsprefresh-wikikube_staging]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Rsyslog::Conf[cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-aux_front_proxy].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-aux_front_proxy]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-aux_front_proxy]
-    ensure   => present
-    priority => 40

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Service[cfssl-ocspserve@wikikube_front_proxy]

Parameters differences:

--- Service[cfssl-ocspserve@wikikube_front_proxy].orig
+++ Service[cfssl-ocspserve@wikikube_front_proxy]

-    ensure => running
-    enable => True

Logrotate::Conf[wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- Logrotate::Conf[wmf_auto_restart_apache-htcacheclean].orig
+++ Logrotate::Conf[wmf_auto_restart_apache-htcacheclean]

-    ensure => absent

Logrotate::Conf[cfssl-ocsprefresh-aux]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-aux].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-aux]

-    ensure => present

Systemd::Unit[cfssl-ocspserve@aux_front_proxy]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@aux_front_proxy].orig
+++ Systemd::Unit[cfssl-ocspserve@aux_front_proxy]

-    override          => False
-    unit              => cfssl-ocspserve@aux_front_proxy
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

File[/etc/cfssl/signers/network_devices/ca/network_devices-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/network_devices/ca/network_devices-key.pem].orig
+++ File[/etc/cfssl/signers/network_devices/ca/network_devices-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/network_devices/ca/network_devices-key.pem.orig
+++ /etc/cfssl/signers/network_devices/ca/network_devices-key.pem
@@ -1 +0,0 @@
-fake key

Nrpe::Check[check_check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_cloud_wmnet_ca].orig
+++ Nrpe::Check[check_check_certificate_expiry_cloud_wmnet_ca]

-    before    => Monitoring::Service[check_certificate_expiry_cloud_wmnet_ca]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem

File[/srv/cfssl/bundles/puppet_rsa.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/puppet_rsa.pem].orig
+++ File[/srv/cfssl/bundles/puppet_rsa.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/puppet_rsa.pem.orig
+++ /srv/cfssl/bundles/puppet_rsa.pem
@@ -1,30 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIFNDCCBJagAwIBAgIUOR+ZAFtrzLKYphDIGMa9eF6O0LIwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjIwMTIwNTAwWhcNMjgwNjE4MTIwNTAwWjB4
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRMwEQYDVQQDDApwdXBwZXRfcnNhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
-MIICCgKCAgEA4urK5Og7RVGoXg6KzYywzaXyRROuj0Kauc7n/BgCWvsKv9Ll4f/p
-lbVGOSln3akzhBlJwmVTGrgCmWQVxMF2agKAR+R1aV2Wc+yEfofUbW1oRgBCelMQ
-Xutw0cApO+lzjHNtduffeIEVBjwLcEG/OdaUa2CGFGLG/dHox7o8AZgkH7SFJyby
-z/rzip+szHpMThhjs0PKx91VS1srb7Q1jE1OlB7ydhX+gLRWTjwxOp1ITFXjNobk
-i16jcP3YYgCvj8qwWMcYmtI7iExSeFdptv3fmajBeoi1o52LUWKUrslwtNa/emaB
-FBGRZfu8ap+BWWpYYarI4mOCyvetw/6FZ2LnuWy5cNA3GoALB5xfLpO3twYnrveP
-BnxULp4Q8szITB/bjPBMkd8FG8Frpe3eZNKNHG9xjJGdS1Bxhq7Zgfy09V1RJCym
-AJSWERHRrxjEnRCDd7HUAhfaDCygeooe4wGRR5bG8WqOpkQDtYPP3yfk5NBhcJpW
-mXTRFTFkuslEL/2bwa9EPIOAKAINDeJOCHqJMQd6EXwTP2LabWU3oI+sfeBdCoSd
-Rn+q2Z0kSLu8fqXsgPgvdgyWjfPkQnyLAz9rdsal2x4x9SilDkov+l6Q9DXGGoYO
-GGOHHFCFhM9CS02zFGLe1JbqiHPuYuIkEnGjGJyCqdIB8Rz0JxdypEcCAwEAAaOC
-AQwwggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1Ud
-DgQWBBRrq/ZHBKl8OZGQrQCiUq4GRc86YDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yA
-vzVxg5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9w
-a2kuZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3Rf
-Q0EwSgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQv
-Y3JsL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCB
-hwJBJHrjuBvyK8Sv40xCW/TrVtOCIVaXfjwsKau9lkmt/6purO/xkppZDMajueYw
-9koKhj6SvliOpiwgypfOKP7nbsACQgFAnawARDYCoOQ8pQDoqpRkPBBScMOTMPFu
-xTekxW2V7POn9dn6uavLJz/wha+sNgAnYT4wHWkRJzbUk+1H3Hb3NA==
------END CERTIFICATE-----

Nrpe::Monitor_service[check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_wikikube_front_proxy].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_wikikube_front_proxy]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: wikikube_front_proxy
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

File[/etc/cfssl/signers/network_devices/ca]

Parameters differences:

--- File[/etc/cfssl/signers/network_devices/ca].orig
+++ File[/etc/cfssl/signers/network_devices/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_aux_front_proxy command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_aux_front_proxy
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "99cf4f8f014e8fd527800abcc213f494" --timeout 10 --check-command "check_check_certificate_expiry_aux_front_proxy"

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_dse command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_dse
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "4384c5ebc49e03dbe331e279fac3f393" --timeout 10 --check-command "check_check_certificate_expiry_dse"

Sudo::User[nrpe-check_check_certificate_expiry_discovery2026]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_discovery2026].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_discovery2026]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery2026/ca/discovery2026.pem']
-    user       => nagios

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]
-    ensure   => present
-    priority => 40

Service[nrpe2nodexp-check_certificate_expiry_etcd.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_etcd.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_etcd.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_etcd.timer (nrpe2nodexp-check_certificate_expiry_etcd.timer)]']

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Sudo::User[nrpe_certificate_check_network_devices]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_network_devices].orig
+++ Sudo::User[nrpe_certificate_check_network_devices]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_network_devices

File[/usr/local/bin/prometheus-check-aux-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-aux-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-aux-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Service[cfssl-ocspserve@cloud_wmnet_ca]

Parameters differences:

--- Service[cfssl-ocspserve@cloud_wmnet_ca].orig
+++ Service[cfssl-ocspserve@cloud_wmnet_ca]

-    ensure => running
-    enable => True

File[/srv/cfssl/bundles/debmonitor.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/debmonitor.pem].orig
+++ File[/srv/cfssl/bundles/debmonitor.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/debmonitor.pem.orig
+++ /srv/cfssl/bundles/debmonitor.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqzCCAw6gAwIBAgIUD8gl+8iTKG2ZJ9eRsZs5/C9/7ZMwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMzE0MTM0NTAwWhcNMjgwMzEyMTM0NTAwWjB4
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRMwEQYDVQQDEwpkZWJtb25pdG9yMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
-AAQBNH4qwApzKzoZpcUF5+rzNhzi2ETF1ToNoWJ4XIJH/PmYzcXmDj41+b+4p4++
-M+ENQtHt6dfCVv0BmGr8XYTU3YUAQUiLhv/X41GLwCV4Nx5jsnpnlfyi2tfXY2b1
-WgpdkxBTQi79fWYWJFvuy7AFhP0ahKcKfauegEHf1zJ/j7pKyjSjggEMMIIBCDAO
-BgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU35FY
-TrdI8tZ8bKAVj8qkrn5sp9QwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9p
-EzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2Nv
-dmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1Ud
-HwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtp
-bWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYCQXXZh0fs
-XIlOkz1OPSSRBbEZ6zjvGEJvR6qPVpdkQ8IY+bwqe6J/wrhlAgWfTq7ODhEQYCnx
-y9Jdg7TfybUaOnmiAkEGKMoHIi/MXfzVrKicaCo4aHIL14vN3V4go08bIsMuIs7p
-EknA+x7QLKFunnrATNeeF6ETr+3u9/MUDWGW+fBqEw==
------END CERTIFICATE-----

File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_network_devices_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@zuul.service (cfssl-ocspserve@zuul)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@zuul]']
-    command     => /bin/systemctl daemon-reload

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_puppet_rsa.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_puppet_rsa.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/var/log/cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-puppet_rsa].orig
+++ File[/var/log/cfssl-ocsprefresh-puppet_rsa]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Prometheus::Node_textfile[prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-cassandra-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-cassandra-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-cassandra-certificate-expiry --cert-path /etc/cfssl/signers/cassandra/ca/cassandra.pem --outfile /var/lib/prometheus/node.d/cassandra_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Motd::Message[pki::multirootca]

Parameters differences:

--- Motd::Message[pki::multirootca].orig
+++ Motd::Message[pki::multirootca]

-    priority => 5
-    message  => pki1001 is a PKI server (pki::multirootca)
-    ensure   => present

Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging_front_proxy]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging_front_proxy].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging_front_proxy]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: mlserve_staging_front_proxy
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_front_proxy.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_mlserve_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem

Cfssl::Config[etcd]

Parameters differences:

--- Cfssl::Config[etcd].orig
+++ Cfssl::Config[etcd]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/etcd
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/etcd/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/etcd

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_discovery]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_discovery.service

Systemd::Service[cfssl-ocsprefresh-discovery]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-discovery].orig
+++ Systemd::Service[cfssl-ocsprefresh-discovery]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-discovery.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Profile::Pki::Multirootca::Monitoring[mlserve]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[mlserve].orig
+++ Profile::Pki::Multirootca::Monitoring[mlserve]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/mlserve/ca/mlserve.pem
-    intermediate => mlserve

Cfssl::Cert[OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_aux_front_proxy_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_aux_front_proxy_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-aux_front_proxy]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => aux_front_proxy
-    notify          => Service[cfssl-ocspserve@aux_front_proxy]
-    profile         => ocsp

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging_front_proxy]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging_front_proxy].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging_front_proxy]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/rsyslog.d/40-wmf-auto-restart-apache2.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-wmf-auto-restart-apache2.conf].orig
+++ File[/etc/rsyslog.d/40-wmf-auto-restart-apache2.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-wmf-auto-restart-apache2.conf.orig
+++ /etc/rsyslog.d/40-wmf-auto-restart-apache2.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "wmf_auto_restart_apache2" then {
-    action(
-        type="omfile" file="/var/log/wmf_auto_restart_apache2/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Exec[Generate initial CRL for mlserve_staging]

Parameters differences:

--- Exec[Generate initial CRL for mlserve_staging].orig
+++ Exec[Generate initial CRL for mlserve_staging]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/mlserve_staging
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/mlserve_staging

File[/etc/cfssl/signers/zuul/ca/zuul.pem]

Parameters differences:

--- File[/etc/cfssl/signers/zuul/ca/zuul.pem].orig
+++ File[/etc/cfssl/signers/zuul/ca/zuul.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/zuul/ca/zuul.pem.orig
+++ /etc/cfssl/signers/zuul/ca/zuul.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpzCCAwigAwIBAgIUMIxkteGnxVGRNFWjJZ+eXPnOeM8wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjUwODIwMTg1NTAwWhcNMzAwODE5MTg1NTAwWjBy
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ0wCwYDVQQDEwR6dXVsMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBNx/m
-dSpc4EWI68Y36PVvDkvyqlJ6pA4sEXQCrNOM+0jSACRM8Shwqr7uC/JmuP8GIdK3
-g+SgxQOjF9pfelX2OpAB6leOfgHXhFtzJquX261tKsxQm74cszycF9YTiWDKVq0V
-g7bFNgf4NcC7NxGfN4SuA58I7dQWJxSWdzTJNQsF2uijggEMMIIBCDAOBgNVHQ8B
-Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUqyQEoVfbsJqL
-jr5RyZovCpWdRZUwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYI
-KwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53
-bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEw
-P6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFf
-SW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgER9R3mwAtzYcIh
-HAnL2SiHTXBpqitQp6Ce+7nYFP0qyu+Ggkx2bu86bl32lGmvA6ecTKXDiyXW5pMW
-atmKn0wAegJCAaU9pfWuLIgsVqzB2zvDWMR2HgBMa6MO7dRlG2VUoLvR16NF9cln
-XjNzIqPRxUpiD5TNC4+p9BoT+RRXEDUeRufH
------END CERTIFICATE-----

Systemd::Syslog[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Systemd::Service[cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-debmonitor].orig
+++ Systemd::Service[cfssl-ocsprefresh-debmonitor]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-debmonitor.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Cfssl::Cert[OCSP_wikikube_staging_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_wikikube_staging_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_wikikube_staging_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-wikikube_staging]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => wikikube_staging
-    notify          => Service[cfssl-ocspserve@wikikube_staging]
-    profile         => ocsp

Exec[Generate initial CRL for aux]

Parameters differences:

--- Exec[Generate initial CRL for aux].orig
+++ Exec[Generate initial CRL for aux]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/aux
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/aux/ca/aux.pem /etc/cfssl/signers/aux/ca/aux-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/aux

Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-syslog-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/lib/systemd/system/cfssl-gc-expired-certs.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-gc-expired-certs.service].orig
+++ File[/lib/systemd/system/cfssl-gc-expired-certs.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-gc-expired-certs.service (cfssl-gc-expired-certs.service)]

Content differences:

--- /lib/systemd/system/cfssl-gc-expired-certs.service.orig
+++ /lib/systemd/system/cfssl-gc-expired-certs.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Delete expired Certificates from the cfssl DB
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-certs clean

Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_apache2.service (wmf_auto_restart_apache2.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/discovery2026]

Parameters differences:

--- File[/etc/cfssl/signers/discovery2026].orig
+++ File[/etc/cfssl/signers/discovery2026]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-dse_front_proxy.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Monitoring::Service[check_cfssl-multirootca_status]

Parameters differences:

--- Monitoring::Service[check_cfssl-multirootca_status].orig
+++ Monitoring::Service[check_cfssl-multirootca_status]

-    check_command  => nrpe_check!check_check_cfssl-multirootca_status!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI
-    description    => Check unit status of cfssl-multirootca
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => True
-    retries        => 2
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 10

Concat::Fragment[main]

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-mlserve_front_proxy-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_front_proxy_intermediate.prom

Sudo::User[nrpe-check_check_certificate_expiry_syslog]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_syslog].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_syslog]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem']
-    user       => nagios

Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_d2a76a31e44e204e2d4788a2698d0e6c]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_d2a76a31e44e204e2d4788a2698d0e6c].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_d2a76a31e44e204e2d4788a2698d0e6c]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_wikikube))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="d2a76a31e44e204e2d4788a2698d0e6c",check_name="check_check_certificate_expiry_wikikube", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__wikikube
-    group              => nrpechecks
-    severity           => info

File[/etc/cfssl/signers/discovery]

Parameters differences:

--- File[/etc/cfssl/signers/discovery].orig
+++ File[/etc/cfssl/signers/discovery]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/etc/update-motd.d/05-pki--multirootca]

Parameters differences:

--- File[/etc/update-motd.d/05-pki--multirootca].orig
+++ File[/etc/update-motd.d/05-pki--multirootca]

-    mode   => 0555
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/update-motd.d/05-pki--multirootca.orig
+++ /etc/update-motd.d/05-pki--multirootca
@@ -1,2 +0,0 @@
-#!/bin/sh
-printf "%s\n" "pki1001 is a PKI server (pki::multirootca)"

File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging.service (cfssl-ocspserve@wikikube_staging)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@wikikube_staging.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@wikikube_staging.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (wikikube_staging)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20020 \
-          -responses /etc/cfssl/ocsp/wikikube_staging.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[cfssl-ocsprefresh-debmonitor.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-debmonitor.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-debmonitor.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-debmonitor.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Prometheus::Blackbox::Check::Http[PKI_mlserve_staging_front_proxy]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_mlserve_staging_front_proxy].orig
+++ Prometheus::Blackbox::Check::Http[PKI_mlserve_staging_front_proxy]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"mlserve_staging_front_proxy"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_front_proxy.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_wikikube_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem

Firewall::Service[csr_and_ocsp_responder]

Parameters differences:

--- Firewall::Service[csr_and_ocsp_responder].orig
+++ Firewall::Service[csr_and_ocsp_responder]

-    desc                => 
-    prio                => 10
-    unrestricted_access => False
-    src_sets            => ['DOMAIN_NETWORKS', 'MGMT_NETWORKS']
-    proto               => tcp
-    port                => 80
-    ensure              => present
-    notrack             => False

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.timer (nrpe2nodexp-check_certificate_expiry_wikikube.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.service

File[/srv/cfssl/crl]

Parameters differences:

--- File[/srv/cfssl/crl].orig
+++ File[/srv/cfssl/crl]

-    owner  => root
-    group  => root
-    ensure => directory

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-mlserve.timer]']

Systemd::Service[cfssl-ocspserve@mlserve_staging]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@mlserve_staging].orig
+++ Systemd::Service[cfssl-ocspserve@mlserve_staging]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-debmonitor-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-debmonitor-certificate-expiry --cert-path /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --outfile /var/lib/prometheus/node.d/debmonitor_intermediate.prom

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Prometheus::Blackbox::Check::Http[PKI_aux_front_proxy]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_aux_front_proxy].orig
+++ Prometheus::Blackbox::Check::Http[PKI_aux_front_proxy]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"aux_front_proxy"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Systemd::Timer[cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-puppet_rsa].orig
+++ Systemd::Timer[cfssl-ocsprefresh-puppet_rsa]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-puppet_rsa.service

Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.timer]']

Exec[Generate initial CRL for wikikube_staging_front_proxy]

Parameters differences:

--- Exec[Generate initial CRL for wikikube_staging_front_proxy].orig
+++ Exec[Generate initial CRL for wikikube_staging_front_proxy]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/wikikube_staging_front_proxy
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/wikikube_staging_front_proxy

Systemd::Syslog[wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- Systemd::Syslog[wmf_auto_restart_apache-htcacheclean].orig
+++ Systemd::Syslog[wmf_auto_restart_apache-htcacheclean]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => absent
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-puppet_rsa.service (cfssl-ocsprefresh-puppet_rsa.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[renew certificate - OCSP_puppet_rsa_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_puppet_rsa_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_puppet_rsa_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_puppet_rsa_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet

File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem].orig
+++ File[/etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chained.pem]

-    owner   => root
-    require => Exec[create chained cert /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.chain.pem]
-    group   => root
-    ensure  => file

File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging]

-    owner  => root
-    group  => root
-    ensure => absent

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_front_proxy.service (cfssl-ocsprefresh-wikikube_front_proxy.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_front_proxy.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - wikikube_front_proxy
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --responses-file /etc/cfssl/ocsp/wikikube_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_front_proxy' wikikube_front_proxy

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse.service (nrpe2nodexp-check_certificate_expiry_dse.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]
-    ensure   => present
-    priority => 40

File[/etc/cfssl/signers/dse/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/dse/cfssl.conf].orig
+++ File[/etc/cfssl/signers/dse/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/dse/cfssl.conf.orig
+++ /etc/cfssl/signers/dse/cfssl.conf
@@ -1,81 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/dse",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/dse"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "service-account-management": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment"
-        ]
-      },
-      "prometheus": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_aux.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_aux]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.service (cfssl-ocsprefresh-wikikube_staging_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.service (cfssl-ocsprefresh-etcd.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[cfssl-ocsprefresh-dse.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-dse.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-dse.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-dse.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-debmonitor.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_debmonitor" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Rsyslog::Conf[cfssl-ocsprefresh-aux]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-aux].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-aux]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-aux]
-    ensure   => present
-    priority => 40

Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    ensure => present

Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_debmonitor_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label debmonitor -profile ocsp /etc/cfssl/csr/OCSP_debmonitor_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_debmonitor_pki1001_eqiad_wmnet

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_mlserve!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: mlserve
-    check_interval         => 1

File[/var/log/cfssl-ocsprefresh-mlserve]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-mlserve].orig
+++ File[/var/log/cfssl-ocsprefresh-mlserve]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Nrpe::Check[check_check_certificate_expiry_zuul]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_zuul].orig
+++ Nrpe::Check[check_check_certificate_expiry_zuul]

-    before    => Monitoring::Service[check_certificate_expiry_zuul]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-puppet_rsa-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry --cert-path /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --outfile /var/lib/prometheus/node.d/puppet_rsa_intermediate.prom

Systemd::Service[cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-aux_front_proxy].orig
+++ Systemd::Service[cfssl-ocsprefresh-aux_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-aux_front_proxy.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery.timer (nrpe2nodexp-check_certificate_expiry_discovery.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Systemd::Timer[cfssl-ocsprefresh-discovery]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-discovery].orig
+++ Systemd::Timer[cfssl-ocsprefresh-discovery]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-discovery.service

File[/usr/local/bin/prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-wikikube-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-wikikube-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Cfssl::Signer[mlserve]

Parameters differences:

--- Cfssl::Signer[mlserve].orig
+++ Cfssl::Signer[mlserve]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDqTCCAwugAwIBAgIUC2E+U3FwNsKpcXq1D5KD3ILh08QwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB1
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRAwDgYDVQQDEwdtbHNlcnZlMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA
4+yIcr5bDRYOqvzsS95b/CFOM84v7vZlxRXO9paOop7nSpVED1+upVrhfM69F4Rd
hMDYeRBUiXxZsecByAdWu0AAEWeCZiL+QqMEJeoGML8iobA6rGa+5y2qePBUcV5m
4u0sePHBq8CYXdIgPHo8bIho/A30Q/IhwEIln0OoSq1ZlcOjggEMMIIBCDAOBgNV
HQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUYMFEsH4H
fAVzgmuJIW+M+s7UPVEwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYw
VgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVy
eS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRD
MEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVk
aWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQUW5mZclFy2C
6VREX3v/LuAnzguojsBHnRSGXWR1TYoN8aBrtzC0w6KaC+5ka5VCByGmlMDY4GxF
GLuM8bnvHf4FAkIBva6mukWZ7ZKbNSGakTVG3PeEvZs1b4xkq7+6RYjlv819FjLm
jPag2y90JiWcyA7gw4IZqc3BgFuT46K+AqsKzhY=
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/mlserve
-    db_host          => localhost
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => nosecret

-    ca_file          => /etc/cfssl/signers/mlserve/ca/mlserve.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    ca_key_file      => /etc/cfssl/signers/mlserve/ca/mlserve-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/mlserve
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

File[/lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@cloud_wmnet_ca.service (cfssl-ocspserve@cloud_wmnet_ca)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@cloud_wmnet_ca.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (cloud_wmnet_ca)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10004 \
-          -responses /etc/cfssl/ocsp/cloud_wmnet_ca.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@etcd.service (cfssl-ocspserve@etcd)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@etcd]']
-    command     => /bin/systemctl daemon-reload

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_network_devices]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_network_devices].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_network_devices]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_network_devices!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: network_devices
-    check_interval         => 1

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-front-proxy.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_staging_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service (prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Service[cfssl-ocsprefresh-zuul]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-zuul].orig
+++ Systemd::Service[cfssl-ocsprefresh-zuul]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-zuul.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Service[cfssl-ocspserve@puppet_rsa]

Parameters differences:

--- Service[cfssl-ocspserve@puppet_rsa].orig
+++ Service[cfssl-ocspserve@puppet_rsa]

-    ensure => running
-    enable => True

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-front-proxy.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-mlserve_front_proxy" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-mlserve_front_proxy/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-mlserve_staging]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-mlserve_staging]
-    ensure   => present
-    priority => 40

File[/srv/cfssl/bundles/discovery2026.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/discovery2026.pem].orig
+++ File[/srv/cfssl/bundles/discovery2026.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/discovery2026.pem.orig
+++ /srv/cfssl/bundles/discovery2026.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrzCCAxGgAwIBAgIUa46nWae1FhV+WZzdsRMJchzTP54wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjYwNDIwMTUzNjAwWhcNMzEwNDE5MTUzNjAwWjB7
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRYwFAYDVQQDEw1kaXNjb3ZlcnkyMDI2MIGbMBAGByqGSM49AgEGBSuBBAAj
-A4GGAAQBNeE+xxvbq00KO92aWhHFTLosZBkXul9ufZINtOUd90TXpQnJvpEv7kK8
-HQpufac9Dez+MBhLzQXoTY+ElhRCsQQBwlu+rIeqpbJEh87DQ2RTfzhTJmlm/9de
-1fiM38/51DacwYS/vW0psN/lKSoM7cX/Paw6Qg7pBUmUGCq2vE9wDbmjggEMMIIB
-CDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU
-SXZcMeXrgnEYbZ3z1m8j/+8XmugwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR
-0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRp
-c2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoG
-A1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9X
-aWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQgD4
-UGn506FGvacDvYS6t8JEMo6YH7jxK8dKeiZNEnhG5FSjA4Lt2BCz85sOBczxSD9h
-b9wLCxy5wOpifRePlyrZQgJBNKUXBImWpyoHmt6hNOA6X7+FmGl0tD5tLnbeuPx7
-aTlv8rfJ0d7JdsZXx+7M6YcsmxMgZCKUh4UMYu/WcczIq30=
------END CERTIFICATE-----

Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.service

Systemd::Unit[cfssl-ocsprefresh-syslog.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-syslog.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-syslog.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-syslog.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.service (nrpe2nodexp-check_certificate_expiry_zuul.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_zuul.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_zuul command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_zuul
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "373325faaa689f3e9b058d91d4eb6cdb" --timeout 10 --check-command "check_check_certificate_expiry_zuul"

Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Prometheus::Node_textfile[prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-kafka-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-kafka-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-kafka-certificate-expiry --cert-path /etc/cfssl/signers/kafka/ca/kafka.pem --outfile /var/lib/prometheus/node.d/kafka_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Cfssl::Config[aux_front_proxy]

Parameters differences:

--- Cfssl::Config[aux_front_proxy].orig
+++ Cfssl::Config[aux_front_proxy]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/aux_front_proxy
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/aux_front_proxy/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/aux_front_proxy

Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-mlserve_staging]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Service[cfssl-ocsprefresh-wikikube.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-wikikube.timer].orig
+++ Service[cfssl-ocsprefresh-wikikube.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.timer)]']

Systemd::Service[wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- Systemd::Service[wmf_auto_restart_apache-htcacheclean].orig
+++ Systemd::Service[wmf_auto_restart_apache-htcacheclean]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service

Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@wikikube.service (cfssl-ocspserve@wikikube)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@wikikube]']
-    command     => /bin/systemctl daemon-reload

Systemd::Syslog[cfssl-gc-expired-certs]

Parameters differences:

--- Systemd::Syslog[cfssl-gc-expired-certs].orig
+++ Systemd::Syslog[cfssl-gc-expired-certs]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Monitoring::Service[check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_puppet_rsa].orig
+++ Monitoring::Service[check_certificate_expiry_puppet_rsa]

-    check_command  => nrpe_check!check_check_certificate_expiry_puppet_rsa!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: puppet_rsa
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_network_devices]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_network_devices].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_network_devices]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Systemd::Unit[cfssl-ocsprefresh-cassandra.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-cassandra.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-cassandra.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-cassandra.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-dse-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-dse-certificate-expiry --cert-path /etc/cfssl/signers/dse/ca/dse.pem --outfile /var/lib/prometheus/node.d/dse_intermediate.prom

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cassandra.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cassandra.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_cassandra.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@mlserve]']
-    command     => /bin/systemctl daemon-reload

Rsyslog::Conf[cfssl-ocsprefresh-wikikube_front_proxy]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-wikikube_front_proxy].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-wikikube_front_proxy]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-wikikube_front_proxy]
-    ensure   => present
-    priority => 40

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]']

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.service (nrpe2nodexp-check_certificate_expiry_kafka.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-wikikube_staging-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-wikikube_staging-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_intermediate.prom

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Syslog[cfssl-ocsprefresh-aux]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-aux].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-aux]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_front_proxy.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Logrotate::Conf[cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-debmonitor].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-debmonitor]

-    ensure => present

Prometheus::Alert::Rule[check_check_certificate_expiry_cassandra_f5e260f525c48c963fb2e6c86a0d5d63]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_cassandra_f5e260f525c48c963fb2e6c86a0d5d63].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_cassandra_f5e260f525c48c963fb2e6c86a0d5d63]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_cassandra))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: cassandra
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: cassandra
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="f5e260f525c48c963fb2e6c86a0d5d63",check_name="check_check_certificate_expiry_cassandra", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__cassandra
-    group              => nrpechecks
-    severity           => info

Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service

Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet

File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem].orig
+++ File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem.orig
+++ /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem
@@ -1,19 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDBjCCAmegAwIBAgIUJzV1YuedEKoaCkVVX4sGAX6x9eMwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjEwMzI1MTMyNzAwWhcNMzEwMzIzMTMyNzAwWjCB
-nDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNh
-biBGcmFuY2lzY28xIjAgBgNVBAoTGVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMx
-FzAVBgNVBAsTDkNsb3VkIFNlcnZpY2VzMSMwIQYDVQQDDBpXaWtpbWVkaWFfSW50
-ZXJuYWxfUm9vdF9DQTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAVJE6KrM3i7m
-7uw5oZ71qWvcQv9wBoNU3nrEqPCDPRd4FS/THrd+OqmnxhJ5UIUhE31H3Ev52dNP
-LQ+274G2MR9dACOGB4/21O1Ng5aKNAgF0NjwS50RAQmRaGs9f7kQg7coDDBqKQj0
-GF6wG1tMI0/wdmi71d1qPX5BDYy+xGQZe1Bao0IwQDAOBgNVHQ8BAf8EBAMCAQYw
-DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUO62iceY0vRv8gL81cYOR0O9pEzYw
-CgYIKoZIzj0EAwQDgYwAMIGIAkIB64t/CBqDBhti8ERNX+rUh7k7zaZw0mllpfDa
-90Gp4vUr5jNTOYi5+Was8xNHz6SCtZK6BkxjF+yb8ogG4ZknV7kCQgD6jCQHgXUx
-mwKWMrxkrfv/yLCSytHfKCm0HSSyXKpHzKbPaIkt83JQxOoKpBmdHjPjkzVC1vjR
-EVQD+PGFu+xryQ==
------END CERTIFICATE-----

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.service (nrpe2nodexp-check_certificate_expiry_cassandra.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_cassandra command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_cassandra
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "f5e260f525c48c963fb2e6c86a0d5d63" --timeout 10 --check-command "check_check_certificate_expiry_cassandra"

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-discovery2026.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-discovery2026" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-discovery2026/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Cfssl::Ocsp[cloud_wmnet_ca]

Parameters differences:

--- Cfssl::Ocsp[cloud_wmnet_ca].orig
+++ Cfssl::Ocsp[cloud_wmnet_ca]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 10004
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

Cfssl::Ocsp[wikikube_staging]

Parameters differences:

--- Cfssl::Ocsp[wikikube_staging].orig
+++ Cfssl::Ocsp[wikikube_staging]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 20020
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

File[/etc/ssl/dhparam.pem]

Parameters differences:

--- File[/etc/ssl/dhparam.pem].orig
+++ File[/etc/ssl/dhparam.pem]

-    mode   => 0444
-    source => puppet:///modules/sslcert/dhparam.pem
-    ensure => present
-    owner  => root
-    group  => root

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-wikikube-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-wikikube-certificate-expiry --cert-path /etc/cfssl/signers/wikikube/ca/wikikube.pem --outfile /var/lib/prometheus/node.d/wikikube_intermediate.prom

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_syslog.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_syslog command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_syslog
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "e3b9b989d5062ce2d267023dfe42fcd8" --timeout 10 --check-command "check_check_certificate_expiry_syslog"

File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_front_proxy].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_mlserve_front_proxy]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_mlserve_front_proxy!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: mlserve_front_proxy
-    check_interval         => 1

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_wikikube!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: wikikube
-    check_interval         => 1

Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Exec[Generate cert puppet_rsa__pki_discovery_wmnet]

Parameters differences:

--- Exec[Generate cert puppet_rsa__pki_discovery_wmnet].orig
+++ Exec[Generate cert puppet_rsa__pki_discovery_wmnet]

-    require     => Cfssl::Csr[/etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr]
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet-key.pem 2>&1)"

-    environment => ['GODEBUG=x509ignoreCN=0']
-    notify      => ['Service[apache2]']
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa  /etc/cfssl/csr/puppet_rsa__pki_discovery_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet

Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-etcd.timer (cfssl-ocsprefresh-etcd.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-etcd.timer]']

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/etc/sudoers.d/nrpe_certificate_check_discovery2026]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_discovery2026].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_discovery2026]

-    owner  => root
-    group  => root
-    ensure => absent

Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.timer (cfssl-ocsprefresh-syslog.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-syslog.timer]']

Systemd::Syslog[cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-dse_front_proxy].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-dse_front_proxy]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_kafka.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_kafka.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_kafka.prom]

-    owner  => root
-    group  => root
-    ensure => absent

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_network_devices.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_network_devices.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_network_devices.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Prometheus::Node_textfile[prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_front_proxy_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_discovery2026.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Prometheus::Node_textfile[prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-etcd-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-etcd-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-etcd-certificate-expiry --cert-path /etc/cfssl/signers/etcd/ca/etcd.pem --outfile /var/lib/prometheus/node.d/etcd_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.timer (cfssl-ocsprefresh-mlserve.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-mlserve.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-mlserve.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Httpd::Conf[defaults]

Parameters differences:

--- Httpd::Conf[defaults].orig
+++ Httpd::Conf[defaults]

-    conf_type => conf
-    source    => puppet:///modules/httpd/defaults.conf
-    priority  => 0
-    ensure    => present

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]
-    ensure   => present
-    priority => 40

File[/etc/logrotate.d/cfssl-ocsprefresh-network_devices]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-network_devices].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-network_devices]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-network_devices.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-network_devices
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-network_devices
-
-/var/log/cfssl-ocsprefresh-network_devices/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf].orig
+++ File[/etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf.orig
+++ /etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/cloud_wmnet_ca",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/cloud_wmnet_ca"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/etc/cfssl/db.conf]

Parameters differences:

--- File[/etc/cfssl/db.conf].orig
+++ File[/etc/cfssl/db.conf]

-    mode      => 0440
-    require   => ['Package[golang-cfssl]']
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/db.conf.orig
+++ /etc/cfssl/db.conf
@@ -1 +0,0 @@
-{"driver":"mysql","data_source":"pki:changeme@tcp(m1-master.eqiad.wmnet:3306)/pki?parseTime=true&tls=skip-verify"}

Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-aux_front_proxy.service (cfssl-ocsprefresh-aux_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Logrotate::Conf[cfssl-ocsprefresh-etcd]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-etcd].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-etcd]

-    ensure => present

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-mlserve-staging-front-proxy.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-mlserve_staging_front_proxy" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-mlserve_staging_front_proxy/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Cfssl::Config[wikikube]

Parameters differences:

--- Cfssl::Config[wikikube].orig
+++ Cfssl::Config[wikikube]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/wikikube
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/wikikube/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/wikikube

Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service (prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-debmonitor-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-debmonitor-certificate-expiry --cert-path /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --outfile /var/lib/prometheus/node.d/debmonitor_intermediate.prom

Systemd::Syslog[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-dse-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Prometheus::Alert::Rule[check_check_certificate_expiry_puppet_rsa_c1b324b3d8ac107f8d7483b4017f5edf]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_puppet_rsa_c1b324b3d8ac107f8d7483b4017f5edf].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_puppet_rsa_c1b324b3d8ac107f8d7483b4017f5edf]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_puppet_rsa))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: puppet_rsa
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: puppet_rsa
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="c1b324b3d8ac107f8d7483b4017f5edf",check_name="check_check_certificate_expiry_puppet_rsa", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__puppet_rsa
-    group              => nrpechecks
-    severity           => info

Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_aux_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-dse-certificate-expiry]
-    ensure   => present
-    priority => 40

Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-discovery-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Class[Profile::Monitoring]

Parameters differences:

--- Class[Profile::Monitoring].orig
+++ Class[Profile::Monitoring]

@@
-    notifications_enabled => True
+    notifications_enabled => False
@@
-    cluster               => pki
+    cluster               => insetup
@@
-    nagios_group          => pki_eqiad
+    nagios_group          => insetup_eqiad

Systemd::Service[cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-mlserve_staging].orig
+++ Systemd::Service[cfssl-ocsprefresh-mlserve_staging]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-mlserve_staging.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Systemd::Timer[wmf_auto_restart_apache2]

Parameters differences:

--- Systemd::Timer[wmf_auto_restart_apache2].orig
+++ Systemd::Timer[wmf_auto_restart_apache2]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 22:8:00'}]
-    unit_name          => wmf_auto_restart_apache2.service

Sudo::User[nrpe-check_check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_wikikube_front_proxy].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_wikikube_front_proxy]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem']
-    user       => nagios

Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]']

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cassandra.timer (nrpe2nodexp-check_certificate_expiry_cassandra.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cassandra.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_cassandra.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_cassandra.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-dse-front-proxy.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-dse_front_proxy" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-dse_front_proxy/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_front_proxy.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_front_proxy.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_wikikube_front_proxy.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Monitoring::Exported_nagios_service[pki1001 check_cfssl-multirootca_status]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_cfssl-multirootca_status].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_cfssl-multirootca_status]

-    max_check_attempts     => 2
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins,sms,admins
-    check_command          => nrpe_check!check_check_cfssl-multirootca_status!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 240
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check unit status of cfssl-multirootca #page
-    check_interval         => 10

Systemd::Service[cfssl-ocspserve@wikikube]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@wikikube].orig
+++ Systemd::Service[cfssl-ocspserve@wikikube]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

File[/etc/logrotate.d/cfssl-ocsprefresh-aux]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-aux].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-aux]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-aux.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-aux
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-aux
-
-/var/log/cfssl-ocsprefresh-aux/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/apache2/mods-available/status.conf]

Parameters differences:

--- File[/etc/apache2/mods-available/status.conf].orig
+++ File[/etc/apache2/mods-available/status.conf]

-    require => Package[apache2]
-    ensure  => absent
-    before  => Httpd::Mod_conf[status]
-    owner   => root
-    group   => root

Service[cfssl-ocspserve@debmonitor]

Parameters differences:

--- Service[cfssl-ocspserve@debmonitor].orig
+++ Service[cfssl-ocspserve@debmonitor]

-    ensure => running
-    enable => True

Cfssl::Ocsp[debmonitor]

Parameters differences:

--- Cfssl::Ocsp[debmonitor].orig
+++ Cfssl::Ocsp[debmonitor]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 10001
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

Systemd::Syslog[cfssl-ocsprefresh-zuul]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-zuul].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-zuul]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-wikikube_staging_front_proxy]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-wikikube_staging_front_proxy]
-    ensure   => present
-    priority => 40

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-kafka-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-kafka-certificate-expiry --cert-path /etc/cfssl/signers/kafka/ca/kafka.pem --outfile /var/lib/prometheus/node.d/kafka_intermediate.prom

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]
-    ensure   => present
-    priority => 40

Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Logrotate::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    ensure => present

File[/etc/apache2/sites-available]

Parameters differences:

--- File[/etc/apache2/sites-available].orig
+++ File[/etc/apache2/sites-available]

-    mode    => 0755
-    require => Package[apache2]
-    ensure  => directory
-    owner   => root
-    group   => root

Systemd::Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Cfssl::Cert[OCSP_network_devices_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_network_devices_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_network_devices_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-network_devices]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => network_devices
-    notify          => Service[cfssl-ocspserve@network_devices]
-    profile         => ocsp

File[/etc/cfssl/ocsp/network_devices.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/network_devices.ocsp].orig
+++ File[/etc/cfssl/ocsp/network_devices.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Service[cfssl-ocsprefresh-wikikube_front_proxy.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-wikikube_front_proxy.timer].orig
+++ Service[cfssl-ocsprefresh-wikikube_front_proxy.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_puppet_rsa].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_puppet_rsa.service

File[/etc/sudoers.d/nrpe_certificate_check_wikikube]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_wikikube].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_wikikube]

-    owner  => root
-    group  => root
-    ensure => absent

Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: wikikube_staging
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

Parameters differences:

--- Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA].orig
+++ Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

-    ensure => running
-    enable => True

Service[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_debmonitor.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_debmonitor.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]']

Service[cfssl-ocsprefresh-dse.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-dse.timer].orig
+++ Service[cfssl-ocsprefresh-dse.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Systemd::Service[cfssl-ocspserve@etcd]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@etcd].orig
+++ Systemd::Service[cfssl-ocspserve@etcd]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Prometheus::Blackbox::Check::Http[PKI_zuul]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_zuul].orig
+++ Prometheus::Blackbox::Check::Http[PKI_zuul]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"zuul"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Cfssl::Ocsp[mlserve_staging]

Parameters differences:

--- Cfssl::Ocsp[mlserve_staging].orig
+++ Cfssl::Ocsp[mlserve_staging]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 20040
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

Nrpe::Monitor_service[check_certificate_expiry_aux]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_aux].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_aux]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: aux
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service (prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-zuul-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-zuul-certificate-expiry --cert-path /etc/cfssl/signers/zuul/ca/zuul.pem --outfile /var/lib/prometheus/node.d/zuul_intermediate.prom

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/srv/cfssl/bundles/dse.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/dse.pem].orig
+++ File[/srv/cfssl/bundles/dse.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/dse.pem.orig
+++ /srv/cfssl/bundles/dse.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpTCCAwegAwIBAgIUb4Tdc/LBMz08oj3vXm9vyvVoa8kwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjBx
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQwwCgYDVQQDEwNkc2UwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAEKIsRi
-rMZazQ75DhhEGhtUEr3248uYpcVNJ3Mp/1IdsIkgdy3vU97D4x+FWvbcITOzw9xz
-apIVnwWIAU7hei4jEwCAIr3llako75gtbD7Xvq9y6UDUcp/LOGBkmGMBktL2Q9qz
-Dgc4AgI29X2/hGBuYEglW2Qhpnbu0+q+7Xi/eKSG3aOCAQwwggEIMA4GA1UdDwEB
-/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSp3KLmcR8APKuf
-wQNUAmw4ugiWrzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
-BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
-bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
-oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
-bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCBhwJCAYGa4oeqY5OQzJhU
-JqhW7Wn0V5dXQ3F0LJKbf70afe5Xx/jkMKMXv6cpUoCgq6OW5CzFHvwyYGDYc3Uy
-Dj63k3tQAkFP3CHPBJahbaziMXpat5mFpYeRit/bScad+W+ysdXe4wLSRK3skzhU
-pOp2n7NgGJQbM1fWuRcBPMQLEZVFsbo04A==
------END CERTIFICATE-----

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.timer (nrpe2nodexp-check_certificate_expiry_debmonitor.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Monitoring::Service[check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_mlserve_staging].orig
+++ Monitoring::Service[check_certificate_expiry_mlserve_staging]

-    check_command  => nrpe_check!check_check_certificate_expiry_mlserve_staging!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: mlserve_staging
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_staging command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_mlserve_staging
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "7cff186656c3cabbca85b5b57d0c8679" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_staging"

Exec[renew certificate - OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_dse_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_dse_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet

Prometheus::Alert::Rule[check_check_certificate_expiry_aux_front_proxy_99cf4f8f014e8fd527800abcc213f494]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_aux_front_proxy_99cf4f8f014e8fd527800abcc213f494].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_aux_front_proxy_99cf4f8f014e8fd527800abcc213f494]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_aux_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: aux_front_proxy
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: aux_front_proxy
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="99cf4f8f014e8fd527800abcc213f494",check_name="check_check_certificate_expiry_aux_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__aux_front_proxy
-    group              => nrpechecks
-    severity           => info

Logrotate::Conf[cfssl-ocsprefresh-zuul]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-zuul].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-zuul]

-    ensure => present

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_wikikube]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem

Motd::Script[insetup::infrastructure_foundations_ferm]

Parameters differences:

--- Motd::Script[insetup::infrastructure_foundations_ferm].orig
+++ Motd::Script[insetup::infrastructure_foundations_ferm]

+    ensure   => present
+    priority => 5

Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_wikikube_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube -profile ocsp /etc/cfssl/csr/OCSP_wikikube_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet

Systemd::Unit[cfssl-ocspserve@mlserve_front_proxy]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@mlserve_front_proxy].orig
+++ Systemd::Unit[cfssl-ocspserve@mlserve_front_proxy]

-    override          => False
-    unit              => cfssl-ocspserve@mlserve_front_proxy
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Systemd::Service[cfssl-ocsprefresh-cloud_wmnet_ca]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-cloud_wmnet_ca].orig
+++ Systemd::Service[cfssl-ocsprefresh-cloud_wmnet_ca]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-cloud_wmnet_ca.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Systemd::Timer::Job[cfssl-ocsprefresh-aux]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-aux].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-aux]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - aux
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/aux/ca/aux.pem --responses-file /etc/cfssl/ocsp/aux.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@aux' aux

Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_mlserve_staging]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: mlserve_staging
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

Systemd::Timer[cfssl-ocsprefresh-mlserve]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-mlserve].orig
+++ Systemd::Timer[cfssl-ocsprefresh-mlserve]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-mlserve.service

File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]']

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cassandra]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cassandra].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_cassandra]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File_line[auto_restart_file_presence_apache-htcacheclean]

Parameters differences:

--- File_line[auto_restart_file_presence_apache-htcacheclean].orig
+++ File_line[auto_restart_file_presence_apache-htcacheclean]

-    line    => apache-htcacheclean
-    require => File[/etc/debdeploy-client/autorestarts.conf]
-    path    => /etc/debdeploy-client/autorestarts.conf
-    ensure  => absent

Service[cfssl-ocspserve@wikikube]

Parameters differences:

--- Service[cfssl-ocspserve@wikikube].orig
+++ Service[cfssl-ocspserve@wikikube]

-    ensure => running
-    enable => True

File[/lib/systemd/system/cfssl-ocspserve@discovery2026.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@discovery2026.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@discovery2026.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@discovery2026.service (cfssl-ocspserve@discovery2026)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@discovery2026.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@discovery2026.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (discovery2026)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10010 \
-          -responses /etc/cfssl/ocsp/discovery2026.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Systemd::Service[cfssl-ocspserve@cloud_wmnet_ca]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@cloud_wmnet_ca].orig
+++ Systemd::Service[cfssl-ocspserve@cloud_wmnet_ca]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer (nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

Profile::Pki::Multirootca::Monitoring[discovery]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[discovery].orig
+++ Profile::Pki::Multirootca::Monitoring[discovery]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/discovery/ca/discovery.pem
-    intermediate => discovery

Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube_front_proxy.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-wikikube_front_proxy.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/logrotate.d/cfssl-ocsprefresh-dse]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-dse].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-dse]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-dse.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-dse
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-dse
-
-/var/log/cfssl-ocsprefresh-dse/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Cfssl::Ocsp[wikikube]

Parameters differences:

--- Cfssl::Ocsp[wikikube].orig
+++ Cfssl::Ocsp[wikikube]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 20010
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/wikikube/ca/wikikube.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

Systemd::Unit[cfssl-ocspserve@etcd]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@etcd].orig
+++ Systemd::Unit[cfssl-ocspserve@etcd]

-    override          => False
-    unit              => cfssl-ocspserve@etcd
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

File[/etc/cfssl/signers/discovery/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/discovery/cfssl.conf].orig
+++ File[/etc/cfssl/signers/discovery/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/discovery/cfssl.conf.orig
+++ /etc/cfssl/signers/discovery/cfssl.conf
@@ -1,129 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "digital signature",
-        "key encipherment",
-        "server auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/discovery",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/discovery"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_staging": {
-        "auth_key": "k8s_staging",
-        "expiry": "24h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_wikikube": {
-        "auth_key": "k8s_wikikube",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_mlserve": {
-        "auth_key": "k8s_mlserve",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_mlstaging": {
-        "auth_key": "k8s_mlstaging",
-        "expiry": "24h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "k8s_dse": {
-        "auth_key": "k8s_dse",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth",
-          "client auth"
-        ]
-      },
-      "k8s_dse_opensearch": {
-        "auth_key": "k8s_dse",
-        "expiry": "4380h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth",
-          "client auth"
-        ]
-      },
-      "k8s_aux": {
-        "auth_key": "k8s_aux",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Prometheus::Node_textfile[prometheus-check-dse_front_proxy-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-dse_front_proxy-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-dse_front_proxy-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-dse_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --outfile /var/lib/prometheus/node.d/dse_front_proxy_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

File[/usr/local/bin/prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-cassandra-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-cassandra-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Cfssl::Signer[dse]

Parameters differences:

--- Cfssl::Signer[dse].orig
+++ Cfssl::Signer[dse]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDpTCCAwegAwIBAgIUb4Tdc/LBMz08oj3vXm9vyvVoa8kwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjBx
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMQwwCgYDVQQDEwNkc2UwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAEKIsRi
rMZazQ75DhhEGhtUEr3248uYpcVNJ3Mp/1IdsIkgdy3vU97D4x+FWvbcITOzw9xz
apIVnwWIAU7hei4jEwCAIr3llako75gtbD7Xvq9y6UDUcp/LOGBkmGMBktL2Q9qz
Dgc4AgI29X2/hGBuYEglW2Qhpnbu0+q+7Xi/eKSG3aOCAQwwggEIMA4GA1UdDwEB
/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSp3KLmcR8APKuf
wQNUAmw4ugiWrzAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GLADCBhwJCAYGa4oeqY5OQzJhU
JqhW7Wn0V5dXQ3F0LJKbf70afe5Xx/jkMKMXv6cpUoCgq6OW5CzFHvwyYGDYc3Uy
Dj63k3tQAkFP3CHPBJahbaziMXpat5mFpYeRit/bScad+W+ysdXe4wLSRK3skzhU
pOp2n7NgGJQbM1fWuRcBPMQLEZVFsbo04A==
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/dse
-    db_host          => localhost
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => 
-    ca_file          => /etc/cfssl/signers/dse/ca/dse.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    ca_key_file      => /etc/cfssl/signers/dse/ca/dse-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/dse
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Package[apache2]

Parameters differences:

--- Package[apache2].orig
+++ Package[apache2]

-    provider => apt
-    ensure   => installed

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_etcd]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_etcd].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_etcd]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_etcd command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_etcd
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "c834f873297e445663ead81279c0b928" --timeout 10 --check-command "check_check_certificate_expiry_etcd"

File[/lib/systemd/system/cfssl-ocsprefresh-dse.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-dse.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-dse.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.service (cfssl-ocsprefresh-dse.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-dse.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-dse.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - dse
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/dse/ca/dse.pem --responses-file /etc/cfssl/ocsp/dse.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@dse' dse

Nrpe::Check[check_check_certificate_expiry_aux]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_aux].orig
+++ Nrpe::Check[check_check_certificate_expiry_aux]

-    before    => Monitoring::Service[check_certificate_expiry_aux]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux/ca/aux.pem

Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_mlserve_staging_front_proxy]

-    owner  => root
-    group  => root
-    ensure => absent

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_kafka.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_kafka.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Prometheus::Alert::Rule[check_check_certificate_expiry_cloud_wmnet_ca_f87f54115f2f782169eed72541c30a1e]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_cloud_wmnet_ca_f87f54115f2f782169eed72541c30a1e].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_cloud_wmnet_ca_f87f54115f2f782169eed72541c30a1e]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_cloud_wmnet_ca))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: cloud_wmnet_ca
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="f87f54115f2f782169eed72541c30a1e",check_name="check_check_certificate_expiry_cloud_wmnet_ca", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__cloud_wmnet_ca
-    group              => nrpechecks
-    severity           => info

Nrpe::Check[check_check_certificate_expiry_dse]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_dse].orig
+++ Nrpe::Check[check_check_certificate_expiry_dse]

-    before    => Monitoring::Service[check_certificate_expiry_dse]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse/ca/dse.pem

Systemd::Timer::Job[cfssl-ocsprefresh-dse]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-dse].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-dse]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - dse
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/dse/ca/dse.pem --responses-file /etc/cfssl/ocsp/dse.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@dse' dse

File[/etc/cfssl/signers/kafka/ca/kafka.pem]

Parameters differences:

--- File[/etc/cfssl/signers/kafka/ca/kafka.pem].orig
+++ File[/etc/cfssl/signers/kafka/ca/kafka.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/kafka/ca/kafka.pem.orig
+++ /etc/cfssl/signers/kafka/ca/kafka.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqDCCAwmgAwIBAgIUTWT2navXkMW9fz3oUB7Fc6azbKcwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjExMDI4MTMwNjAwWhcNMjYxMDI3MTMwNjAwWjBz
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQ4wDAYDVQQDEwVrYWZrYTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAScI
-AVY36upnobdfvpQJ7Y5uefRAv0OsdtR++HEqm2kTatOG4BJTdjdBv3+gyd3rJccd
-DEifyU1EcxVVXjjXzqdHADiJ+Zol5mwexbnrpF8JDBiJv7ntNamdr7Xjv4kw8Tkp
-kgl70aFalPLjpwjDNyrm2ACxPmHxK8EOu7eXb8RImqeVo4IBDDCCAQgwDgYDVR0P
-AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFGIY/nB0tTtl
-RGdO5J4ck+RM8p8rMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2MFYG
-CCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zlcnku
-d21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBB
-MD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1lZGlh
-X0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBv8ZMP7g8aPkc
-tcrO4rXcBkhFIWH9+4H4iTbuSBtjVtUXdsRW++IU89BjVVKQxv/4ZDm8hlpd+vJU
-b9xj3WUpi8cCQgFpjYqKVM+I5eRpIjhWoPxognJtGI3626wAOpV2CPauciD51gP3
-up2xe36OG3Z8XDcbNGoNiG3505+af9zBrt3c4g==
------END CERTIFICATE-----

File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Logrotate::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    ensure => present

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging_front_proxy.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging_front_proxy.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve_staging_front_proxy.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Class[Adduser]

Parameters differences:

--- Class[Adduser].orig
+++ Class[Adduser]

@@
-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[quickstack]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[atop]', 'Package[libpython2.7]', 'Package[libpython2.7-dev]', 'Package[libpython2.7-minimal]', 'Package[python2.7]', 'Package[libpython2.7-stdlib]', 'Package[python2.7-dev]', 'Package[python2.7-minimal]', 'Package[python2.7-dbg]', 'Package[python2.7-doc]', 'Package[python2.7-examples]', 'Package[libpython2.7-testsuite]', 'Package[intel-microcode]', 'Package[rasdaemon]', 'Package[libsnmp30]', 'Package[libdns-export1104]', 'Package[libdns1104]', 'Package[libisc-export1100]', 'Package[libisc1100]', 'Package[multiarch-support]', 'Package[libjson-c3]', 'Package[libpython3.7]', 'Package[libpython3.7-minimal]', 'Package[libpython3.7-stdlib]', 'Package[python3.7]', 'Package[python3.7-minimal]', 'Package[libevent-2.1-6]', 'Package[libwireshark11]', 'Package[libwiretap8]', 'Package[libwsutil9]', 'Package[libwscodecs2]', 'Package[libperl5.28]', 'Package[libmpdec2]', 'Package[perl-modules-5.28]', 'Package[libhogweed4]', 'Package[libnettle6]', 'Package[libprocps7]', 'Package[libip6tc0]', 'Package[libip4tc0]', 'Package[libiptc0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[apache2]', 'Package[links]', 'Package[ruby-sys-filesystem]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[python3-pymysql]', 'Package[python3-cryptography]']
+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[quickstack]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[atop]', 'Package[libpython2.7]', 'Package[libpython2.7-dev]', 'Package[libpython2.7-minimal]', 'Package[python2.7]', 'Package[libpython2.7-stdlib]', 'Package[python2.7-dev]', 'Package[python2.7-minimal]', 'Package[python2.7-dbg]', 'Package[python2.7-doc]', 'Package[python2.7-examples]', 'Package[libpython2.7-testsuite]', 'Package[intel-microcode]', 'Package[rasdaemon]', 'Package[libsnmp30]', 'Package[libdns-export1104]', 'Package[libdns1104]', 'Package[libisc-export1100]', 'Package[libisc1100]', 'Package[multiarch-support]', 'Package[libjson-c3]', 'Package[libpython3.7]', 'Package[libpython3.7-minimal]', 'Package[libpython3.7-stdlib]', 'Package[python3.7]', 'Package[python3.7-minimal]', 'Package[libevent-2.1-6]', 'Package[libwireshark11]', 'Package[libwiretap8]', 'Package[libwsutil9]', 'Package[libwscodecs2]', 'Package[libperl5.28]', 'Package[libmpdec2]', 'Package[perl-modules-5.28]', 'Package[libhogweed4]', 'Package[libnettle6]', 'Package[libprocps7]', 'Package[libip6tc0]', 'Package[libip4tc0]', 'Package[libiptc0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[ruby-sys-filesystem]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']

Profile::Pki::Multirootca::Monitoring[network_devices]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[network_devices].orig
+++ Profile::Pki::Multirootca::Monitoring[network_devices]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/network_devices/ca/network_devices.pem
-    intermediate => network_devices

Cfssl::Ocsp[syslog]

Parameters differences:

--- Cfssl::Ocsp[syslog].orig
+++ Cfssl::Ocsp[syslog]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 10007
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/syslog/ca/syslog.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-puppet_rsa.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-puppet_rsa.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Unit[cfssl-ocspserve@zuul]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@zuul].orig
+++ Systemd::Unit[cfssl-ocspserve@zuul]

-    override          => False
-    unit              => cfssl-ocspserve@zuul
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Prometheus::Node_textfile[prometheus-check-puppet_rsa-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-puppet_rsa-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-puppet_rsa-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-puppet_rsa-certificate-expiry --cert-path /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem --outfile /var/lib/prometheus/node.d/puppet_rsa_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Service[cfssl-ocsprefresh-cassandra.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-cassandra.timer].orig
+++ Service[cfssl-ocsprefresh-cassandra.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@wikikube_staging_front_proxy.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (wikikube_staging_front_proxy)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20021 \
-          -responses /etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Exec[Generate initial CRL for discovery2026]

Parameters differences:

--- Exec[Generate initial CRL for discovery2026].orig
+++ Exec[Generate initial CRL for discovery2026]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/discovery2026
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/discovery2026/ca/discovery2026.pem /etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/discovery2026

File[/lib/systemd/system/cfssl-ocspserve@discovery.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@discovery.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@discovery.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@discovery.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@discovery.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (discovery)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10002 \
-          -responses /etc/cfssl/ocsp/discovery.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[cfssl-ocspserve@mlserve_staging]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@mlserve_staging].orig
+++ Systemd::Unit[cfssl-ocspserve@mlserve_staging]

-    override          => False
-    unit              => cfssl-ocspserve@mlserve_staging
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Cfssl::Cert[OCSP_cassandra_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_cassandra_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_cassandra_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-cassandra]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => cassandra
-    notify          => Service[cfssl-ocspserve@cassandra]
-    profile         => ocsp

Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery -profile ocsp /etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet

Sudo::User[nrpe-check_check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_dse_front_proxy].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_dse_front_proxy]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem']
-    user       => nagios

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.timer (cfssl-ocsprefresh-wikikube_staging.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-wikikube_staging.timer]']

Cfssl::Config[wikikube_front_proxy]

Parameters differences:

--- Cfssl::Config[wikikube_front_proxy].orig
+++ Cfssl::Config[wikikube_front_proxy]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/wikikube_front_proxy
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/wikikube_front_proxy/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/wikikube_front_proxy

Exec[Generate initial CRL for mlserve_front_proxy]

Parameters differences:

--- Exec[Generate initial CRL for mlserve_front_proxy].orig
+++ Exec[Generate initial CRL for mlserve_front_proxy]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/mlserve_front_proxy
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/mlserve_front_proxy

Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service

File[/etc/sudoers.d/nrpe_certificate_check_aux_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_aux_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_aux_front_proxy]

-    owner  => root
-    group  => root
-    ensure => absent

File[/etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp].orig
+++ File[/etc/cfssl/ocsp/wikikube_staging_front_proxy.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.timer]']

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service (nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_mlserve.prom]

-    owner  => root
-    group  => root
-    ensure => absent

File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.service (nrpe2nodexp-check_cfssl-multirootca_status.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_cfssl-multirootca_status command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_cfssl-multirootca_status
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "52832284a5fb8b8ea6f55bb6271912c9" --timeout 10 --check-command "check_check_cfssl-multirootca_status" --page

Rsyslog::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
-    ensure   => present
-    priority => 40

File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_wikikube_staging_front_proxy]

-    owner  => root
-    group  => root
-    ensure => absent

Logrotate::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    ensure => present

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_cloud_wmnet_ca.service

Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-zuul.timer (cfssl-ocsprefresh-zuul.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-zuul.timer]']

Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service]

-    override          => False
-    unit              => nrpe2nodexp-check_cfssl-multirootca_status.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Nrpe::Check[check_check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_puppet_rsa].orig
+++ Nrpe::Check[check_check_certificate_expiry_puppet_rsa]

-    before    => Monitoring::Service[check_certificate_expiry_puppet_rsa]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem

Systemd::Service[cfssl-ocsprefresh-kafka]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-kafka].orig
+++ Systemd::Service[cfssl-ocsprefresh-kafka]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-kafka.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Sudo::User[nrpe_certificate_check_dse_front_proxy]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_dse_front_proxy].orig
+++ Sudo::User[nrpe_certificate_check_dse_front_proxy]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_dse_front_proxy

Cfssl::Db[multirootca-db]

Parameters differences:

--- Cfssl::Db[multirootca-db].orig
+++ Cfssl::Db[multirootca-db]

-    python_config     => True
-    driver            => mysql
-    dbname            => pki
-    username          => pki
-    ssl_checkhostname => False
-    notify_service    => cfssl-multirootca
-    ssl_ca            => /etc/ssl/certs/wmf-ca-certificates.crt
-    host              => m1-master.eqiad.wmnet
-    dbcharset         => utf8mb4
-    port              => 3306
-    conf_file         => /etc/cfssl/db.conf
-    password          => changeme

Systemd::Service[nrpe2nodexp-check_certificate_expiry_debmonitor]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_debmonitor].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_debmonitor]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_debmonitor.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service].orig
+++ File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.service (wmf_auto_restart_apache-htcacheclean.service)]

Content differences:

--- /lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service.orig
+++ /lib/systemd/system/wmf_auto_restart_apache-htcacheclean.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Auto restart job: apache-htcacheclean
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/wmf-auto-restart -s apache-htcacheclean

Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label wikikube_staging_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_front_proxy_pki1001_eqiad_wmnet

File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_etcd_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Prometheus::Alert::Rule[check_check_certificate_expiry_network_devices_21dac3775d059b8c991626e2ca33f951]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_network_devices_21dac3775d059b8c991626e2ca33f951].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_network_devices_21dac3775d059b8c991626e2ca33f951]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_network_devices))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: network_devices
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: network_devices
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="21dac3775d059b8c991626e2ca33f951",check_name="check_check_certificate_expiry_network_devices", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__network_devices
-    group              => nrpechecks
-    severity           => info

File[/var/log/cfssl-ocsprefresh-discovery]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-discovery].orig
+++ File[/var/log/cfssl-ocsprefresh-discovery]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube_front_proxy
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem

Logrotate::Conf[cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-mlserve_front_proxy]

-    ensure => present

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.service (cfssl-ocsprefresh-mlserve_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Monitoring::Service[check_certificate_expiry_kafka]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_kafka].orig
+++ Monitoring::Service[check_certificate_expiry_kafka]

-    check_command  => nrpe_check!check_check_certificate_expiry_kafka!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: kafka
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-staging-front-proxy-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Service[cfssl-ocsprefresh-syslog]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-syslog].orig
+++ Systemd::Service[cfssl-ocsprefresh-syslog]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-syslog.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-wikikube_staging_front_proxy-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_front_proxy_intermediate.prom

Nrpe::Check[check_check_certificate_expiry_mlserve_front_proxy]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_mlserve_front_proxy].orig
+++ Nrpe::Check[check_check_certificate_expiry_mlserve_front_proxy]

-    before    => Monitoring::Service[check_certificate_expiry_mlserve_front_proxy]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_staging.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_front_proxy_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux.service (nrpe2nodexp-check_certificate_expiry_aux.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_aux command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_aux
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "f7dfe9e2cd77303dfae7ae11c5c56d90" --timeout 10 --check-command "check_check_certificate_expiry_aux"

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-network-devices.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-network_devices" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-network_devices/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Prometheus::Alert::Rule[check_check_certificate_expiry_kafka_22922fd6bc2d570e018cbe5ccd8d1727]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_kafka_22922fd6bc2d570e018cbe5ccd8d1727].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_kafka_22922fd6bc2d570e018cbe5ccd8d1727]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_kafka))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: kafka
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: kafka
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="22922fd6bc2d570e018cbe5ccd8d1727",check_name="check_check_certificate_expiry_kafka", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__kafka
-    group              => nrpechecks
-    severity           => info

Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Sudo::User[nrpe-check_check_certificate_expiry_cassandra]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_cassandra].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_cassandra]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/cassandra/ca/cassandra.pem']
-    user       => nagios

Systemd::Service[cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-discovery2026].orig
+++ Systemd::Service[cfssl-ocsprefresh-discovery2026]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-discovery2026.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca].orig
+++ File[/etc/cfssl/signers/mlserve_staging_front_proxy/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/srv/cfssl]

Parameters differences:

--- File[/srv/cfssl].orig
+++ File[/srv/cfssl]

-    owner  => root
-    group  => root
-    ensure => directory

Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_wikikube_staging_front_proxy]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: wikikube_staging_front_proxy
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging.timer (cfssl-ocsprefresh-mlserve_staging.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-mlserve_staging.timer]']

File[/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_network_devices]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_network_devices].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_network_devices]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_network_devices command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_network_devices
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "21dac3775d059b8c991626e2ca33f951" --timeout 10 --check-command "check_check_certificate_expiry_network_devices"

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.timer (nrpe2nodexp-check_certificate_expiry_syslog.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging_front_proxy.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-wikikube_staging_front_proxy.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-wikikube_staging_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_front_proxy_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Httpd::Site[dummy]

Parameters differences:

--- Httpd::Site[dummy].orig
+++ Httpd::Site[dummy]

-    source   => puppet:///modules/httpd/dummy.conf
-    priority => 0
-    ensure   => present

File[/etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp].orig
+++ File[/etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

File[/srv/cfssl/bundles/aux.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/aux.pem].orig
+++ File[/srv/cfssl/bundles/aux.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/aux.pem.orig
+++ /srv/cfssl/bundles/aux.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpjCCAwegAwIBAgIUB83dKT9lbMGOLf38Jx6fmsSa714wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjBx
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMQwwCgYDVQQDEwNhdXgwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABADhzJSO
-h264ltJ1CVADYcfi1rIxQOY3gtAsxonZ6CWNueKg0vjvDeL32l+NZ3f2yj2CIzl5
-sa6sZjXmwAKziuuvCAHmsZDY5gzgBdwhZ6UeGAbwlLMgQajwRvCA2RUMuH8iAd6o
-QcfZyHQFb0zl9mCHYNkjLT4jpwrL4Lx/DGbmkE/ulqOCAQwwggEIMA4GA1UdDwEB
-/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBSPVQ8kSyOIH5l4
-1mVGCudJoaowtTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kTNjBWBggr
-BgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292ZXJ5Lndt
-bmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0fBEMwQTA/
-oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2ltZWRpYV9J
-bnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJCALJuWafVNInsE4Q8
-tEHYHqhweF6bEArm7d3dqqTjKHuOcrmhXo4rgX5VsXHtI3qq9XGHoik6JUSwgftV
-Sr+GWrIZAkIAuqmJ5vv2LgFcJWvYDkIPH9HXB9rIwAUHPFJ/iX2Ig9By+ss8nJbU
-A3Ml/4NKRsXZwwyScmowVWQHfMpv53BsBv8=
------END CERTIFICATE-----

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_discovery]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_discovery command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_discovery
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "38e4dbcfd07ed60daf5bb89397abbe29" --timeout 10 --check-command "check_check_certificate_expiry_discovery"

Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]']

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_front_proxy].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_wikikube_front_proxy]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_wikikube_front_proxy!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: wikikube_front_proxy
-    check_interval         => 1

Service[wmf_auto_restart_apache2.timer]

Parameters differences:

--- Service[wmf_auto_restart_apache2.timer].orig
+++ Service[wmf_auto_restart_apache2.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- File[/etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa].orig
+++ File[/etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa.orig
+++ /etc/logrotate.d/cfssl-ocsprefresh-puppet_rsa
@@ -1,12 +0,0 @@
-# logrotate(8) config for cfssl-ocsprefresh-puppet_rsa
-
-/var/log/cfssl-ocsprefresh-puppet_rsa/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Prometheus::Blackbox::Check::Http[PKI_cassandra]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_cassandra].orig
+++ Prometheus::Blackbox::Check::Http[PKI_cassandra]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"cassandra"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

File[/var/log/cfssl-ocsprefresh-network_devices]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-network_devices].orig
+++ File[/var/log/cfssl-ocsprefresh-network_devices]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem]

Parameters differences:

--- File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem].orig
+++ File[/etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem.orig
+++ /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsjCCAxOgAwIBAgIUcL3aZt8/kOKuFw8g90SCOk9VZSYwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjE0MTczMTAwWhcNMjgwMjEzMTczMTAwWjB9
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRgwFgYDVQQDDA9hdXhfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
-ACMDgYYABAFQamNeMXOM8jZDTMiL/0Cgk641Tps3tMBQ6f1OD7fqLh7JGWZXSWIE
-9v25H6dgcqSIWAlvBkbHQUPU51GmXigXtwCW1bYWFZc+MTjXFo2LBUJVUIxh2mh3
-pNZYlgVZXP7a0l3zt2u5vegKRuJ6l0ELtjCJjo/TNYo/BA28XrzCL45HO6OCAQww
-ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
-BBQv7ovDzaQTat1sfWJFkZ+n8+aGSTAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
-g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
-ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
-SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
-L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
-AZ7oTip5kp2Yt9BABNEqYi6GjwpXZvmZOgd6So8UA76jP8duYicuOoNvpoHdEy58
-ZOGpo0lqqIzB8xQcvzvmX7uiAkIAxHVKylOLCoPsUXaZVfUGhNavXXwrbIHTQXDo
-HEHmc9lIMh9hO5z4vPMEbMkSRuAskcT1K/ydEqp4xI191jnovUg=
------END CERTIFICATE-----

Exec[renew certificate - OCSP_aux_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_aux_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_aux_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_aux_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label aux -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet

Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    ensure => present

Sudo::User[nrpe_certificate_check_aux]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_aux].orig
+++ Sudo::User[nrpe_certificate_check_aux]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_aux

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve.service (cfssl-ocsprefresh-mlserve.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Syslog[cfssl-ocsprefresh-cassandra]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-cassandra].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-cassandra]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-front-proxy.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_wikikube_front_proxy" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_syslog
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem

Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cassandra -profile ocsp /etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.timer]']

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem].orig
+++ File[/etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem.orig
+++ /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
@@ -1,23 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDwDCCAyGgAwIBAgIUJT4TJHFy4qcc2DDVjG00p9VDOcIwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjCB
-ijELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
-GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
-aW9uczElMCMGA1UEAwwcd2lraWt1YmVfc3RhZ2luZ19mcm9udF9wcm94eTCBmzAQ
-BgcqhkjOPQIBBgUrgQQAIwOBhgAEAQkWDUaTmBFtrLcFLkOP5LV+kGQdr0TIYAMX
-FR7UbUmysish4+UlH7C2vcugX/XmmIoh2asGRkfb0kjTQUUjqDmmANYQARMmx/V4
-j87yMi11K3IxBh2Ei7KJzvXD5yhg/rQa1TVcdvZ1GHBL1QvBU5x2L95G+Exi1amQ
-dC4vktygtdo8o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB
-Af8CAQEwHQYDVR0OBBYEFANI4okfmz36Vpe1jEq4tkgKl5HzMB8GA1UdIwQYMBaA
-FDutonHmNL0b/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcw
-AYY6aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50
-ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2Nv
-dmVyeS53bW5ldC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZI
-zj0EAwQDgYwAMIGIAkIBuKBFQ/g6puAs+HK7+bE4eiatpN7eotPUTNbVuxN4+rEO
-E6JEpXslb/Ad0rVDvEOmXGSH9EdqjCNJs0Qv5kFnqZQCQgCPyFWGoBUxDcWLjOEL
-2a1pt4joI2BUut3NtLOBgPeaI/5qqPoLFbxn/1DMBmZLlsoNhnrg99F5LgvQVEAA
-/3y5tw==
------END CERTIFICATE-----

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=Systemd timer to gather node metrics for prometheus-check-etcd-certificate-expiry
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/bin/prometheus-check-etcd-certificate-expiry --cert-path /etc/cfssl/signers/etcd/ca/etcd.pem --outfile /var/lib/prometheus/node.d/etcd_intermediate.prom

Profile::Pki::Multirootca::Monitoring[syslog]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[syslog].orig
+++ Profile::Pki::Multirootca::Monitoring[syslog]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/syslog/ca/syslog.pem
-    intermediate => syslog

Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_wikikube_staging_front_proxy]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem']
-    user       => nagios

Exec[Generate initial CRL for etcd]

Parameters differences:

--- Exec[Generate initial CRL for etcd].orig
+++ Exec[Generate initial CRL for etcd]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/etcd
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/etcd/ca/etcd.pem /etc/cfssl/signers/etcd/ca/etcd-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/etcd

Systemd::Syslog[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_syslog.service (nrpe2nodexp-check_certificate_expiry_syslog.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/srv/cfssl/bundles/cassandra.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/cassandra.pem].orig
+++ File[/srv/cfssl/bundles/cassandra.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/cassandra.pem.orig
+++ /srv/cfssl/bundles/cassandra.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqjCCAw2gAwIBAgIUN8PPoG0JeyUfDWKQhN0B2AOw4G8wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwNjE5MTI1MDAwWhcNMjgwNjE3MTI1MDAwWjB3
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRIwEAYDVQQDEwljYXNzYW5kcmEwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA
-BABpd+xtElegZM2bsg1caGxmHV5hs7l7qxmKFS3oSAu1jo1+N/uSppDtSWZzG+8C
-zjIrytBMxBWhNqsOw9msEWhbBAEYESw1oKj+APqOlCafGdXQI1ZvMafexxTqDNN1
-CA2gq4ivn82r2Ya3LLqwICxK3MlcmGuLwR5amxiLchok3cZ3X6OCAQwwggEIMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQBN6m6
-eyaSV8l2Il/bwcfpWTmplDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVxg5HQ72kT
-NjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2kuZGlzY292
-ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwSgYDVR0f
-BEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3JsL1dpa2lt
-ZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GKADCBhgJBRhCSOg5L
-+EuYGdsW8T9S/tXzYURZpnQItn2nYjM6ky1nxqG6F+V2WsiijiPpEQxr7QUvfZhf
-D2zhB5BS8ynWCpYCQRGo4eZuUHyRMNqg/ZDljT1dqr09n0wQhszrJ4eCmebLVsDm
-B6AM3pPRygYo0REwxHbpTBAIt26zjGiKiFQqUjwa
------END CERTIFICATE-----

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_syslog.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_syslog.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Nrpe::Monitor_service[check_certificate_expiry_etcd]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_etcd].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_etcd]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: etcd
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

Systemd::Timer[cfssl-ocsprefresh-zuul]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-zuul].orig
+++ Systemd::Timer[cfssl-ocsprefresh-zuul]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-zuul.service

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_debmonitor.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_debmonitor command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_debmonitor
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "224e2ac3574a9ce482218106d95a2931" --timeout 10 --check-command "check_check_certificate_expiry_debmonitor"

File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_etcd_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Service[cfssl-ocsprefresh-aux.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-aux.timer].orig
+++ Service[cfssl-ocsprefresh-aux.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_mlserve_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve -profile ocsp /etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet

Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_dse_front_proxy_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse_front_proxy -profile ocsp /etc/cfssl/csr/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Service[cfssl-ocspserve@wikikube_staging]

Parameters differences:

--- Service[cfssl-ocspserve@wikikube_staging].orig
+++ Service[cfssl-ocspserve@wikikube_staging]

-    ensure => running
-    enable => True

Cfssl::Config[dse]

Parameters differences:

--- Cfssl::Config[dse].orig
+++ Cfssl::Config[dse]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/dse
-    default_auth_remote => {}
-    default_usages      => ['signing', 'key encipherment', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/dse/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'service-account-management': {'usages': ['digital signature', 'key encipherment']}, 'prometheus': {'expiry': '8760h', 'usages': ['digital signature', 'key encipherment', 'client auth']}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/dse

File[/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf].orig
+++ File[/etc/cfssl/signers/mlserve_front_proxy/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/mlserve_front_proxy/cfssl.conf.orig
+++ /etc/cfssl/signers/mlserve_front_proxy/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/mlserve_front_proxy",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/mlserve_front_proxy"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry]
-    ensure   => present
-    priority => 40

Sudo::User[nrpe-check_check_certificate_expiry_network_devices]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_network_devices].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_network_devices]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem']
-    user       => nagios

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/cfssl-ocsprefresh-dse.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-dse.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-dse.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-dse.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-dse.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-dse.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-dse.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_cassandra_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cassandra -profile ocsp /etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer::Job[cfssl-ocsprefresh-cassandra]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-cassandra].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-cassandra]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - cassandra
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/cassandra/ca/cassandra.pem --responses-file /etc/cfssl/ocsp/cassandra.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@cassandra' cassandra

File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Service[cfssl-ocspserve@aux_front_proxy]

Parameters differences:

--- Service[cfssl-ocspserve@aux_front_proxy].orig
+++ Service[cfssl-ocspserve@aux_front_proxy]

-    ensure => running
-    enable => True

File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@mlserve_staging.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging.service (cfssl-ocspserve@mlserve_staging)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@mlserve_staging.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@mlserve_staging.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (mlserve_staging)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20040 \
-          -responses /etc/cfssl/ocsp/mlserve_staging.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_etcd]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_etcd].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_etcd]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Unit[cfssl-ocsprefresh-zuul.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-zuul.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-zuul.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-zuul.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer].orig
+++ Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Prometheus::Node_textfile[prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-wikikube_staging_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_staging_front_proxy_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery2026]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery2026].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_discovery2026]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_discovery2026!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: discovery2026
-    check_interval         => 1

Cfssl::Config[discovery2026]

Parameters differences:

--- Cfssl::Config[discovery2026].orig
+++ Cfssl::Config[discovery2026]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/discovery2026
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/discovery2026/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'k8s_staging': {'expiry': '24h', 'auth_key': 'k8s_staging'}, 'k8s_wikikube': {'auth_key': 'k8s_wikikube'}, 'k8s_mlserve': {'auth_key': 'k8s_mlserve'}, 'k8s_mlstaging': {'expiry': '24h', 'auth_key': 'k8s_mlstaging'}, 'k8s_dse': {'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_dse_opensearch': {'expiry': '4380h', 'auth_key': 'k8s_dse', 'usages': ['digital signature', 'key encipherment', 'server auth', 'client auth']}, 'k8s_aux': {'auth_key': 'k8s_aux'}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/discovery2026

Exec[renew certificate - OCSP_kafka_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_kafka_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_kafka_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label kafka -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet

File[/lib/systemd/system/cfssl-ocspserve@syslog.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@syslog.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@syslog.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@syslog.service (cfssl-ocspserve@syslog)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@syslog.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@syslog.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (syslog)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 10007 \
-          -responses /etc/cfssl/ocsp/syslog.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-dse_front_proxy]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - dse_front_proxy
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem --responses-file /etc/cfssl/ocsp/dse_front_proxy.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@dse_front_proxy' dse_front_proxy

Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-mlserve_staging]

-    ensure => present

Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-wikikube_staging.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Rsyslog::Conf[cfssl-ocsprefresh-etcd]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-etcd].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-etcd]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-etcd]
-    ensure   => present
-    priority => 40

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Service[nrpe2nodexp-check_certificate_expiry_kafka.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_kafka.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_kafka.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_kafka.timer (nrpe2nodexp-check_certificate_expiry_kafka.timer)]']

Rsyslog::Conf[cfssl-ocsprefresh-discovery]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-discovery].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-discovery]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-discovery]
-    ensure   => present
-    priority => 40

Cfssl::Signer[dse_front_proxy]

Parameters differences:

--- Cfssl::Signer[dse_front_proxy].orig
+++ Cfssl::Signer[dse_front_proxy]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDsjCCAxOgAwIBAgIUBGeKXglKnoXGyRgWodaHSfz0z/gwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMjIyMTczMzAwWhcNMjgwMjIxMTczMzAwWjB9
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRgwFgYDVQQDDA9kc2VfZnJvbnRfcHJveHkwgZswEAYHKoZIzj0CAQYFK4EE
ACMDgYYABAGUNx07sN1MWk3DzjEFh3pfYaQVrqo1tWFQjf7URfwqfyZY81Tqt6yl
y/zj3DpvtOmvyI5jPH91yPBaFho0/SpP6wFkBIyE8/Ik2b80slPKuzstrYgBlYsG
+Fxop4CYWjLItOy1Ut82aYr76hNm0goEma9ETjgE4nfBEU3vi77QO/B9E6OCAQww
ggEIMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQW
BBQPHxMmkuy8EqO+Wz7TmM1MfmcXDDAfBgNVHSMEGDAWgBQ7raJx5jS9G/yAvzVx
g5HQ72kTNjBWBggrBgEFBQcBAQRKMEgwRgYIKwYBBQUHMAGGOmh0dHA6Ly9wa2ku
ZGlzY292ZXJ5LndtbmV0L29jc3AvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0Ew
SgYDVR0fBEMwQTA/oD2gO4Y5aHR0cDovL3BraS5kaXNjb3Zlcnkud21uZXQvY3Js
L1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMAoGCCqGSM49BAMEA4GMADCBiAJC
AO3JNb9OyC3JQ3mmkgt+Db3NMgLArYlvcYd8Nd5uWEXm6d6NfUPDN5XBGkjly1B7
N18vKQYxlZzX2wgYqaK9LYs9AkIBch3vTND/M2T78Hhp5YoodasCdLDcpMJ1Qn3T
fI0Lwjt7W50T0FMle6CwZkI+ZrxRzqvic19IUSTDDqwiOFgLhqM=
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/dse_front_proxy
-    db_host          => localhost
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => 
-    ca_file          => /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    ca_key_file      => /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/dse_front_proxy
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_wikikube
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube/ca/wikikube.pem

Exec[Generate initial CRL for mlserve_staging_front_proxy]

Parameters differences:

--- Exec[Generate initial CRL for mlserve_staging_front_proxy].orig
+++ Exec[Generate initial CRL for mlserve_staging_front_proxy]

-    require => ['Package[golang-cfssl]']
-    path    => ['/usr/bin']
-    creates => /srv/cfssl/crl/mlserve_staging_front_proxy
-    command => /usr/bin/cfssl gencrl - /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem 157680000 </dev/null |/usr/bin/base64 -d > /srv/cfssl/crl/mlserve_staging_front_proxy

File[/etc/cfssl/signers/aux_front_proxy/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/aux_front_proxy/cfssl.conf].orig
+++ File[/etc/cfssl/signers/aux_front_proxy/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/aux_front_proxy/cfssl.conf.orig
+++ /etc/cfssl/signers/aux_front_proxy/cfssl.conf
@@ -1,64 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/aux_front_proxy",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/aux_front_proxy"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Profile::Pki::Multirootca::Monitoring[cloud_wmnet_ca]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[cloud_wmnet_ca].orig
+++ Profile::Pki::Multirootca::Monitoring[cloud_wmnet_ca]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
-    intermediate => cloud_wmnet_ca

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_mlserve.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_mlserve.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Concat::Fragment[main contacts]

Sudo::User[nrpe_certificate_check_wikikube]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_wikikube].orig
+++ Sudo::User[nrpe_certificate_check_wikikube]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_wikikube

File[/etc/cfssl/multiroot.conf]

Parameters differences:

--- File[/etc/cfssl/multiroot.conf].orig
+++ File[/etc/cfssl/multiroot.conf]

-    owner  => root
-    group  => root
-    ensure => present
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/multiroot.conf.orig
+++ /etc/cfssl/multiroot.conf
@@ -1,138 +0,0 @@
-[debmonitor]
-private = file:///etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem
-certificate = /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
-config = /etc/cfssl/signers/debmonitor/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[discovery]
-private = file:///etc/cfssl/signers/discovery/ca/discovery-key.pem
-certificate = /etc/cfssl/signers/discovery/ca/discovery.pem
-config = /etc/cfssl/signers/discovery/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[kafka]
-private = file:///etc/cfssl/signers/kafka/ca/kafka-key.pem
-certificate = /etc/cfssl/signers/kafka/ca/kafka.pem
-config = /etc/cfssl/signers/kafka/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[cloud_wmnet_ca]
-private = file:///etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca-key.pem
-certificate = /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem
-config = /etc/cfssl/signers/cloud_wmnet_ca/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[etcd]
-private = file:///etc/cfssl/signers/etcd/ca/etcd-key.pem
-certificate = /etc/cfssl/signers/etcd/ca/etcd.pem
-config = /etc/cfssl/signers/etcd/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[cassandra]
-private = file:///etc/cfssl/signers/cassandra/ca/cassandra-key.pem
-certificate = /etc/cfssl/signers/cassandra/ca/cassandra.pem
-config = /etc/cfssl/signers/cassandra/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[syslog]
-private = file:///etc/cfssl/signers/syslog/ca/syslog-key.pem
-certificate = /etc/cfssl/signers/syslog/ca/syslog.pem
-config = /etc/cfssl/signers/syslog/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[puppet_rsa]
-private = file:///etc/cfssl/signers/puppet_rsa/ca/puppet_rsa-key.pem
-certificate = /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem
-config = /etc/cfssl/signers/puppet_rsa/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[zuul]
-private = file:///etc/cfssl/signers/zuul/ca/zuul-key.pem
-certificate = /etc/cfssl/signers/zuul/ca/zuul.pem
-config = /etc/cfssl/signers/zuul/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[discovery2026]
-private = file:///etc/cfssl/signers/discovery2026/ca/discovery2026-key.pem
-certificate = /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
-config = /etc/cfssl/signers/discovery2026/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[wikikube]
-private = file:///etc/cfssl/signers/wikikube/ca/wikikube-key.pem
-certificate = /etc/cfssl/signers/wikikube/ca/wikikube.pem
-config = /etc/cfssl/signers/wikikube/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[wikikube_front_proxy]
-private = file:///etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy-key.pem
-certificate = /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem
-config = /etc/cfssl/signers/wikikube_front_proxy/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[wikikube_staging]
-private = file:///etc/cfssl/signers/wikikube_staging/ca/wikikube_staging-key.pem
-certificate = /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
-config = /etc/cfssl/signers/wikikube_staging/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[wikikube_staging_front_proxy]
-private = file:///etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy-key.pem
-certificate = /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem
-config = /etc/cfssl/signers/wikikube_staging_front_proxy/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[mlserve]
-private = file:///etc/cfssl/signers/mlserve/ca/mlserve-key.pem
-certificate = /etc/cfssl/signers/mlserve/ca/mlserve.pem
-config = /etc/cfssl/signers/mlserve/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[mlserve_front_proxy]
-private = file:///etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem
-certificate = /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
-config = /etc/cfssl/signers/mlserve_front_proxy/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[mlserve_staging]
-private = file:///etc/cfssl/signers/mlserve_staging/ca/mlserve_staging-key.pem
-certificate = /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem
-config = /etc/cfssl/signers/mlserve_staging/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[mlserve_staging_front_proxy]
-private = file:///etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem
-certificate = /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
-config = /etc/cfssl/signers/mlserve_staging_front_proxy/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[aux]
-private = file:///etc/cfssl/signers/aux/ca/aux-key.pem
-certificate = /etc/cfssl/signers/aux/ca/aux.pem
-config = /etc/cfssl/signers/aux/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[aux_front_proxy]
-private = file:///etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy-key.pem
-certificate = /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem
-config = /etc/cfssl/signers/aux_front_proxy/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[dse]
-private = file:///etc/cfssl/signers/dse/ca/dse-key.pem
-certificate = /etc/cfssl/signers/dse/ca/dse.pem
-config = /etc/cfssl/signers/dse/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[dse_front_proxy]
-private = file:///etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy-key.pem
-certificate = /etc/cfssl/signers/dse_front_proxy/ca/dse_front_proxy.pem
-config = /etc/cfssl/signers/dse_front_proxy/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-
-[network_devices]
-private = file:///etc/cfssl/signers/network_devices/ca/network_devices-key.pem
-certificate = /etc/cfssl/signers/network_devices/ca/network_devices.pem
-config = /etc/cfssl/signers/network_devices/cfssl.conf
-dbconfig = /etc/cfssl/db.conf
-

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-wikikube-front-proxy-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Unit[cfssl-ocsprefresh-aux.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-aux.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-aux.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-aux.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service (nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_dse_front_proxy.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_dse_front_proxy command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_dse_front_proxy
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "2560f4f577ba169af651cf96bd5dc1ba" --timeout 10 --check-command "check_check_certificate_expiry_dse_front_proxy"

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-cassandra-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-cassandra-certificate-expiry --cert-path /etc/cfssl/signers/cassandra/ca/cassandra.pem --outfile /var/lib/prometheus/node.d/cassandra_intermediate.prom

Monitoring::Service[check_certificate_expiry_syslog]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_syslog].orig
+++ Monitoring::Service[check_certificate_expiry_syslog]

-    check_command  => nrpe_check!check_check_certificate_expiry_syslog!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: syslog
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

File[/etc/cfssl/signers/mlserve/ca/mlserve.pem]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve/ca/mlserve.pem].orig
+++ File[/etc/cfssl/signers/mlserve/ca/mlserve.pem]

-    mode   => 0444
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/mlserve/ca/mlserve.pem.orig
+++ /etc/cfssl/signers/mlserve/ca/mlserve.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqTCCAwugAwIBAgIUC2E+U3FwNsKpcXq1D5KD3ILh08QwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjB1
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRAwDgYDVQQDEwdtbHNlcnZlMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA
-4+yIcr5bDRYOqvzsS95b/CFOM84v7vZlxRXO9paOop7nSpVED1+upVrhfM69F4Rd
-hMDYeRBUiXxZsecByAdWu0AAEWeCZiL+QqMEJeoGML8iobA6rGa+5y2qePBUcV5m
-4u0sePHBq8CYXdIgPHo8bIho/A30Q/IhwEIln0OoSq1ZlcOjggEMMIIBCDAOBgNV
-HQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUYMFEsH4H
-fAVzgmuJIW+M+s7UPVEwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYw
-VgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVy
-eS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRD
-MEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVk
-aWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBiwAwgYcCQUW5mZclFy2C
-6VREX3v/LuAnzguojsBHnRSGXWR1TYoN8aBrtzC0w6KaC+5ka5VCByGmlMDY4GxF
-GLuM8bnvHf4FAkIBva6mukWZ7ZKbNSGakTVG3PeEvZs1b4xkq7+6RYjlv819FjLm
-jPag2y90JiWcyA7gw4IZqc3BgFuT46K+AqsKzhY=
------END CERTIFICATE-----

Logrotate::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    ensure => present

Systemd::Timer[cfssl-ocsprefresh-aux]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-aux].orig
+++ Systemd::Timer[cfssl-ocsprefresh-aux]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-aux.service

Systemd::Unit[cfssl-ocspserve@puppet_rsa]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@puppet_rsa].orig
+++ Systemd::Unit[cfssl-ocspserve@puppet_rsa]

-    override          => False
-    unit              => cfssl-ocspserve@puppet_rsa
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_dse]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_dse.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Cfssl::Config[cassandra]

Parameters differences:

--- Cfssl::Config[cassandra].orig
+++ Cfssl::Config[cassandra]

-    notify              => Service[cfssl-multirootca]
-    default_ocsp_url    => http://pki.discovery.wmnet/ocsp/cassandra
-    default_auth_remote => {}
-    default_usages      => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    auth_keys           => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    remotes             => {}
-    path                => /etc/cfssl/signers/cassandra/cfssl.conf
-    ensure              => present
-    profiles            => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    default_expiry      => 672h
-    default_auth_key    => default_auth
-    default_crl_url     => http://pki.discovery.wmnet/crl/cassandra

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_mlserve_staging_front_proxy.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_mlserve_staging_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem

Systemd::Service[cfssl-ocspserve@dse_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@dse_front_proxy].orig
+++ Systemd::Service[cfssl-ocspserve@dse_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet].orig
+++ Exec[Generate cert OCSP_kafka_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet-key.pem 2>&1)"

-    require     => Cfssl::Csr[/etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr]
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label kafka -profile ocsp /etc/cfssl/csr/OCSP_kafka_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_kafka_pki1001_eqiad_wmnet

Systemd::Timer[cfssl-gc-expired-certs]

Parameters differences:

--- Systemd::Timer[cfssl-gc-expired-certs].orig
+++ Systemd::Timer[cfssl-gc-expired-certs]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': 'hourly'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-gc-expired-certs.service

Cfssl::Signer[mlserve_staging_front_proxy]

Parameters differences:

--- Cfssl::Signer[mlserve_staging_front_proxy].orig
+++ Cfssl::Signer[mlserve_staging_front_proxy]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDvjCCAyCgAwIBAgIUV8ha2UdjViI49Xr/fZzbY4YPZdYwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
iTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
aW9uczEkMCIGA1UEAwwbbWxzZXJ2ZV9zdGFnaW5nX2Zyb250X3Byb3h5MIGbMBAG
ByqGSM49AgEGBSuBBAAjA4GGAAQAyrMiWBRjOWCaMXsvXC0wS6VzHyLLGFT8BpM9
EhYcloDfNnb8no2+YXrBzj4+lAg3D3dq53q+hyHko3+YsVVF/qABa55syWkYtxDB
xy5FNq6Iq/s2E3vO2YpQifWXlaSZvvuZCGhhTPDOp/zdI/kKdco9Jehsu6CdyElj
lCgJTZupZCmjggEMMIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB
/wIBATAdBgNVHQ4EFgQUj5l8xt65hr4t5yj8xKYmUsKwk9YwHwYDVR0jBBgwFoAU
O62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzAB
hjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRl
cm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292
ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjO
PQQDBAOBiwAwgYcCQgD24XA2cP2pFwE3onWEosbFqDEaFwD5kNg7eSOkncJIceFU
bCX1f6VOYSv6UbiEQV0EwS0d34EawydbLcqXqfHgpgJBJJjdNhpjAcwyRt1+unRc
dYn6ys1ZElRXMld7NUq+nCInX5cVk8uPeSev6IxIJc2eyBCb4jtjvE3TAQ2RHvT9
sBI=
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/mlserve_staging_front_proxy
-    db_host          => localhost
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => nosecret

-    ca_file          => /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    ca_key_file      => /etc/cfssl/signers/mlserve_staging_front_proxy/ca/mlserve_staging_front_proxy-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 72h
-    default_crl_url  => http://pki.discovery.wmnet/crl/mlserve_staging_front_proxy
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/lib/systemd/system/cfssl-ocspserve@aux.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@aux.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@aux.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@aux.service (cfssl-ocspserve@aux)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@aux.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@aux.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (aux)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20050 \
-          -responses /etc/cfssl/ocsp/aux.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Cfssl::Signer[debmonitor]

Parameters differences:

--- Cfssl::Signer[debmonitor].orig
+++ Cfssl::Signer[debmonitor]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDqzCCAw6gAwIBAgIUD8gl+8iTKG2ZJ9eRsZs5/C9/7ZMwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMzE0MTM0NTAwWhcNMjgwMzEyMTM0NTAwWjB4
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMRMwEQYDVQQDEwpkZWJtb25pdG9yMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
AAQBNH4qwApzKzoZpcUF5+rzNhzi2ETF1ToNoWJ4XIJH/PmYzcXmDj41+b+4p4++
M+ENQtHt6dfCVv0BmGr8XYTU3YUAQUiLhv/X41GLwCV4Nx5jsnpnlfyi2tfXY2b1
WgpdkxBTQi79fWYWJFvuy7AFhP0ahKcKfauegEHf1zJ/j7pKyjSjggEMMIIBCDAO
BgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU35FY
TrdI8tZ8bKAVj8qkrn5sp9QwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9p
EzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2Nv
dmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1Ud
HwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtp
bWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYCQXXZh0fs
XIlOkz1OPSSRBbEZ6zjvGEJvR6qPVpdkQ8IY+bwqe6J/wrhlAgWfTq7ODhEQYCnx
y9Jdg7TfybUaOnmiAkEGKMoHIi/MXfzVrKicaCo4aHIL14vN3V4go08bIsMuIs7p
EknA+x7QLKFunnrATNeeF6ETr+3u9/MUDWGW+fBqEw==
-----END CERTIFICATE-----
-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/debmonitor
-    db_host          => localhost
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => ##### FAKE FOR PUPPET ######

-    ca_file          => /etc/cfssl/signers/debmonitor/ca/debmonitor.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    ca_key_file      => /etc/cfssl/signers/debmonitor/ca/debmonitor-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/debmonitor
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_debmonitor.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_debmonitor.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_debmonitor.prom]

-    owner  => root
-    group  => root
-    ensure => absent

File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Prometheus::Node_textfile[prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-mlserve_staging-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-mlserve_staging-certificate-expiry --cert-path /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem --outfile /var/lib/prometheus/node.d/mlserve_staging_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Nrpe::Check[check_check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Nrpe::Check[check_check_certificate_expiry_wikikube_staging_front_proxy]

-    before    => Monitoring::Service[check_certificate_expiry_wikikube_staging_front_proxy]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging_front_proxy/ca/wikikube_staging_front_proxy.pem

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service (prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[renew certificate - puppet_rsa__pki_discovery_wmnet]

Parameters differences:

--- Exec[renew certificate - puppet_rsa__pki_discovery_wmnet].orig
+++ Exec[renew certificate - puppet_rsa__pki_discovery_wmnet]

-    require     => Exec[Generate cert puppet_rsa__pki_discovery_wmnet]
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.pem -checkend 952200
-    environment => ['GODEBUG=x509ignoreCN=0']
-    notify      => ['Service[apache2]']
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label puppet_rsa  /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet_rsa__pki_discovery_wmnet/puppet_rsa__pki_discovery_wmnet

Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery2026]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery2026].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_discovery2026]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_discovery2026.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-aux.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-aux" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-aux/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Monitoring::Exported_nagios_service[pki1001 ferm_active]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 ferm_active].orig
+++ Monitoring::Exported_nagios_service[pki1001 ferm_active]

@@
-    notifications_enabled => 1
+    notifications_enabled => 0
@@
-    servicegroups         => pki_eqiad
+    servicegroups         => insetup_eqiad

File[/lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@mlserve_front_proxy.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (mlserve_front_proxy)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20031 \
-          -responses /etc/cfssl/ocsp/mlserve_front_proxy.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-syslog.service (cfssl-ocsprefresh-syslog.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Cfssl::Ocsp[dse]

Parameters differences:

--- Cfssl::Ocsp[dse].orig
+++ Cfssl::Ocsp[dse]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 20061
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/dse/ca/dse.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

Systemd::Timer[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-kafka-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service

Systemd::Timer[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-debmonitor-certificate-expiry.service

Systemd::Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_front_proxy_4d759acaf0fd7dd3abaa03dc4565aef6]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_front_proxy_4d759acaf0fd7dd3abaa03dc4565aef6].orig
+++ Prometheus::Alert::Rule[check_check_certificate_expiry_wikikube_front_proxy_4d759acaf0fd7dd3abaa03dc4565aef6]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_certificate_expiry_wikikube_front_proxy))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_front_proxy
-    team               => observability
-    summary            => NRPE CHECK: Check to ensure the signer certificate is valid CA: wikikube_front_proxy
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    def_label_whitelst => ['team', 'severity']
-    for                => 3m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="4d759acaf0fd7dd3abaa03dc4565aef6",check_name="check_check_certificate_expiry_wikikube_front_proxy", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_to_ensure_the_signer_certificate_is_valid_CA__wikikube_front_proxy
-    group              => nrpechecks
-    severity           => info

File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_aux_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0440
-    ensure    => file
-    show_diff => False
-    owner     => root
-    backup    => False
-    group     => root

Prometheus::Node_textfile[prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-wikikube_front_proxy-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-wikikube_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem --outfile /var/lib/prometheus/node.d/wikikube_front_proxy_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.timer]']

File[/srv/cfssl/bundles/cloud_wmnet_ca.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/cloud_wmnet_ca.pem].orig
+++ File[/srv/cfssl/bundles/cloud_wmnet_ca.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/cloud_wmnet_ca.pem.orig
+++ /srv/cfssl/bundles/cloud_wmnet_ca.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrzCCAxKgAwIBAgIURAaLNJ85iLqv3Tqt4ylu7Dhe0o0wCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjExMjEzMTg1NTAwWhcNMjYxMjEyMTg1NTAwWjB8
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRcwFQYDVQQDDA5jbG91ZF93bW5ldF9jYTCBmzAQBgcqhkjOPQIBBgUrgQQA
-IwOBhgAEAFsH4mfZKGu87WTpX9yabGE0+vO4UBQaN/IUGnjmscZTZ7761iAwuZcs
-33yjwzoX2W+R0IwAPJbagtB92uYPmA6eAUDV4WAuOml+AqAP0elVtW7i+T/Bm4qc
-SrlGCDsALgJ765YZCDS9OmzAm9rXbQXFmsxqrm9I3aPXIOWIww5+Zg1mo4IBDDCC
-AQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
-FMavCWJlEuGLgOx5zgBdQCQ0Zxj7MB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGD
-kdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5k
-aXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBK
-BgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwv
-V2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYoAMIGGAkEQ
-XFKpUB99oxOp7uK3GztZblTr8DECjcwbJOXYfZLGyfzzNIKPMGPkBGNmGkP7Ie1G
-RSCNRsI1VR8/geUR0YUrpwJBRZWF4DZM3cga+6VB7pEv/7r/pQERs/ivzckNwDLi
-/LK1pbHc/MeNOdoy7TouLf1djsw40VYtGNT7/9FldHoWqsA=
------END CERTIFICATE-----

Prometheus::Blackbox::Check::Http[PKI_cloud_wmnet_ca]

Parameters differences:

--- Prometheus::Blackbox::Check::Http[PKI_cloud_wmnet_ca].orig
+++ Prometheus::Blackbox::Check::Http[PKI_cloud_wmnet_ca]

-    follow_redirects        => False
-    header_not_matches      => []
-    probe_summary           => Service {{ $labels.instance }} has failed probes ({{ $labels.module }})
-    timeout                 => 3s
-    status_matches          => []
-    header_matches          => []
-    prometheus_instance     => ops
-    site                    => eqiad
-    body_regex_matches      => ['"success":true']
-    ssl_expired_runbook     => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
-    force_tls               => False
-    probe_description       => {{ $labels.instance }} failed when probed by {{ $labels.module }} from {{ $externalLabels.site }}. Availability is {{ $value }}%.
-    port                    => 443
-    req_headers             => {}
-    alert_after             => 2m
-    body_raw                => {"label":"cloud_wmnet_ca"}
-    client_auth_cert        => /etc/prometheus/ssl/cert.pem
-    ssl_expired_dashboard   => https://grafana.wikimedia.org/d/K1dRhGCnz/probes-tls-dashboard
-    ssl_expired_description => The certificate presented by service {{ $labels.instance }} is going to expire in {{ $value | humanizeDuration }}
-    ip4                     => 10.64.0.10
-    client_auth_key         => /etc/prometheus/ssl/server.key
-    server_name             => pki.discovery.wmnet
-    use_client_auth         => True
-    path                    => /api/v1/cfssl/info
-    method                  => POST
-    probe_runbook           => https://wikitech.wikimedia.org/wiki/Runbook#{{ $labels.instance }}
-    ssl_expired_summary     => Certificate for service {{ $labels.instance }} is about to expire
-    team                    => sre
-    insecure_tls            => False
-    ip6                     => 2620:0:861:101:10:64:0:10
-    probe_dashboard         => https://grafana.wikimedia.org/d/O0nHhdhnz/network-probes-overview?var-job={{ $labels.job }}&var-module=All
-    certificate_expiry_days => 10
-    body_regex_not_matches  => []
-    instance_label          => pki1001
-    body                    => {}
-    ip_families             => ['ip4', 'ip6']
-    severity                => critical

Nrpe::Monitor_service[check_certificate_expiry_zuul]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_zuul].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_zuul]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: zuul
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/zuul/ca/zuul.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_aux_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_puppet_rsa
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/puppet_rsa/ca/puppet_rsa.pem

Nrpe::Check[check_check_certificate_expiry_syslog]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_syslog].orig
+++ Nrpe::Check[check_check_certificate_expiry_syslog]

-    before    => Monitoring::Service[check_certificate_expiry_syslog]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem

Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer].orig
+++ Service[cfssl-ocsprefresh-cloud_wmnet_ca.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Systemd::Timer[cfssl-ocsprefresh-wikikube]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-wikikube].orig
+++ Systemd::Timer[cfssl-ocsprefresh-wikikube]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-wikikube.service

Prometheus::Node_textfile[prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-network_devices-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-network_devices-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-network_devices-certificate-expiry --cert-path /etc/cfssl/signers/network_devices/ca/network_devices.pem --outfile /var/lib/prometheus/node.d/network_devices_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-dse-front-proxy.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_dse_front_proxy" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@discovery.service (cfssl-ocspserve@discovery)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@discovery]']
-    command     => /bin/systemctl daemon-reload

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_wikikube_staging_front_proxy]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_mlserve_staging]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_mlserve_staging.service

Systemd::Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-wikikube-staging.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_wikikube_staging" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Class[Httpd]

Parameters differences:

--- Class[Httpd].orig
+++ Class[Httpd]

-    legacy_compat        => present
-    rotate               => 30
-    enable_forensic_log  => False
-    http_only            => False
-    wait_network_online  => False
-    extra_pkgs           => []
-    remove_default_ports => False
-    modules              => ['proxy_http', 'ssl', 'headers']
-    purge_manual_config  => True
-    period               => daily

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_wikikube_staging.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_wikikube_staging]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem

Systemd::Syslog[cfssl-ocsprefresh-debmonitor]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-debmonitor].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-debmonitor]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Cfssl::Ocsp[Wikimedia_Internal_Root_CA]

Parameters differences:

--- Cfssl::Ocsp[Wikimedia_Internal_Root_CA].orig
+++ Cfssl::Ocsp[Wikimedia_Internal_Root_CA]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 10000
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    require            => Service[cfssl-multirootca]
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem
-    cert_content       => -----BEGIN CERTIFICATE-----
MIIDmzCCAvygAwIBAgIUN3uLiKCNVwnGG5H9qKGwTGT4fJowCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjEwMzI1MTQ1MTAwWhcNMjYwMzI0MTQ1MTAwWjCB
mTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxFzAVBgNVBAsTDkNsb3VkIFNlcnZp
Y2VzMTUwMwYDVQQDDCxXaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQV9vY3NwX3Np
Z25pbmdfY2VydDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLmGOcHNNTGsOVTG
17o/lTVCgVJqX751quqBZvJQUbAgfAv0PRgv6yjWzTmZnojzKHYRaV8NXhDIVBzo
l2DRWUOjggEbMIIBFzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUH
AwkwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQULRRzzcjqWQc2Fjci5s2v0FKSPJww
HwYDVR0jBBgwFoAUO62iceY0vRv8gL81cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBI
MEYGCCsGAQUFBzABhjpodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9vY3NwL1dp
a2ltZWRpYV9JbnRlcm5hbF9Sb290X0NBMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6
Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2NybC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
dF9DQTAKBggqhkjOPQQDBAOBjAAwgYgCQgCI41DoiQFxqs9gDCZs4VhwcNeatHqe
98IqBIzFOMdZdkUnyTNiXf0VDkUYZ+n2mYmB5ZAaBTPYhTHgLNrc3KsmpQJCAfHM
Qr3AEz1MlZq2krL+7Mx9OuBQ3B/hXyC+met7EmKDziU8UyScxFfSIY1lwwgAmZHA
OEOWpgzuF4fGZFVf0dFi
-----END CERTIFICATE-----

-    key_content        => FAKE FAKE FAKE

-    db_conf_file       => /etc/cfssl/db.conf
-    db_driver          => mysql

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_discovery2026.service (nrpe2nodexp-check_certificate_expiry_discovery2026.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_discovery2026.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_discovery2026 command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_discovery2026
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "bf2e3510cb63e5f05f545e816bab4edf" --timeout 10 --check-command "check_check_certificate_expiry_discovery2026"

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-etcd-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-etcd-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/etc/sudoers.d/nrpe_certificate_check_mlserve]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_mlserve].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_mlserve]

-    owner  => root
-    group  => root
-    ensure => absent

Systemd::Timer::Job[nrpe2nodexp-check_cfssl-multirootca_status]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_cfssl-multirootca_status].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_cfssl-multirootca_status]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_cfssl-multirootca_status command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_cfssl-multirootca_status
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 300
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "52832284a5fb8b8ea6f55bb6271912c9" --timeout 10 --check-command "check_check_cfssl-multirootca_status" --page

Service[cfssl-ocsprefresh-syslog.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-syslog.timer].orig
+++ Service[cfssl-ocsprefresh-syslog.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Systemd::Unit[cfssl-ocspserve@syslog]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@syslog].orig
+++ Systemd::Unit[cfssl-ocspserve@syslog]

-    override          => False
-    unit              => cfssl-ocspserve@syslog
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

File[/etc/cfssl/signers/zuul/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/zuul/cfssl.conf].orig
+++ File[/etc/cfssl/signers/zuul/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/zuul/cfssl.conf.orig
+++ /etc/cfssl/signers/zuul/cfssl.conf
@@ -1,63 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "server auth",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/zuul",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/zuul"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      }
-    }
-  }
-}

Systemd::Service[cfssl-ocspserve@wikikube_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@wikikube_front_proxy].orig
+++ Systemd::Service[cfssl-ocspserve@wikikube_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Systemd::Unit[cfssl-ocsprefresh-mlserve.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-mlserve.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-mlserve.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-mlserve.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Service[cfssl-ocsprefresh-mlserve_staging.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-mlserve_staging.timer].orig
+++ Service[cfssl-ocsprefresh-mlserve_staging.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/etc/cfssl/ocsp/kafka.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/kafka.ocsp].orig
+++ File[/etc/cfssl/ocsp/kafka.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Rsyslog::Conf[cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-dse_front_proxy].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-dse_front_proxy]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-dse_front_proxy]
-    ensure   => present
-    priority => 40

Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service].orig
+++ Systemd::Unit[wmf_auto_restart_apache-htcacheclean.service]

-    override          => False
-    unit              => wmf_auto_restart_apache-htcacheclean.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube.service (nrpe2nodexp-check_certificate_expiry_wikikube.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_wikikube.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_wikikube
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "d2a76a31e44e204e2d4788a2698d0e6c" --timeout 10 --check-command "check_check_certificate_expiry_wikikube"

Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label cloud_wmnet_ca -profile ocsp /etc/cfssl/csr/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_cloud_wmnet_ca_pki1001_eqiad_wmnet

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-mlserve_staging_front_proxy-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Timer[cfssl-ocsprefresh-cassandra]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-cassandra].orig
+++ Systemd::Timer[cfssl-ocsprefresh-cassandra]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-cassandra.service

Sudo::User[nrpe_certificate_check_discovery2026]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_discovery2026].orig
+++ Sudo::User[nrpe_certificate_check_discovery2026]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_discovery2026

File[/usr/local/bin/prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-syslog-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-syslog-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service (prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.timer (cfssl-ocsprefresh-mlserve_staging_front_proxy.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_staging_front_proxy.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-mlserve_staging_front_proxy.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-mlserve_staging_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_syslog_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label syslog -profile ocsp /etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet

Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_cassandra_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging-front-proxy.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_mlserve_staging_front_proxy" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

Systemd::Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ Systemd::Service[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_kafka]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_kafka].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_kafka]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_kafka command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_kafka
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "22922fd6bc2d570e018cbe5ccd8d1727" --timeout 10 --check-command "check_check_certificate_expiry_kafka"

Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_mlserve_staging]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem']
-    user       => nagios

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service (prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/ssl/localcerts/multiroot_ca.pem]

Parameters differences:

--- File[/etc/ssl/localcerts/multiroot_ca.pem].orig
+++ File[/etc/ssl/localcerts/multiroot_ca.pem]

-    mode   => 0440
-    source => puppet:///modules/profile/pki/production/client_auth_CA.pem
-    ensure => file
-    owner  => root
-    group  => root
-    notify => Service[apache2]

Monitoring::Exported_nagios_service[pki1001 disk_space]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 disk_space].orig
+++ Monitoring::Exported_nagios_service[pki1001 disk_space]

@@
-    notifications_enabled => 1
+    notifications_enabled => 0
@@
-    servicegroups         => pki_eqiad
+    servicegroups         => insetup_eqiad

File[/lib/systemd/system/cfssl-ocspserve@mlserve.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocspserve@mlserve.service].orig
+++ File[/lib/systemd/system/cfssl-ocspserve@mlserve.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocspserve@mlserve.service (cfssl-ocspserve@mlserve)]

Content differences:

--- /lib/systemd/system/cfssl-ocspserve@mlserve.service.orig
+++ /lib/systemd/system/cfssl-ocspserve@mlserve.service
@@ -1,15 +0,0 @@
-[Unit]
-Description=Cloudflare SSL OCSP Responder (mlserve)
-After=network.target remote-fs.target nss-lookup.target
-Documentation=https://github.com/cloudflare/cfssl/tree/master/doc
-
-[Service]
-ExecStart=/usr/bin/cfssl ocspserve \
-          -address 127.0.0.1 \
-          -port 20030 \
-          -responses /etc/cfssl/ocsp/mlserve.ocsp
-Restart=always
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-[Install]
-WantedBy=multi-user.target

Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Systemd::Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Prometheus::Alert::Rule[check_check_cfssl-multirootca_status_52832284a5fb8b8ea6f55bb6271912c9]

Parameters differences:

--- Prometheus::Alert::Rule[check_check_cfssl-multirootca_status_52832284a5fb8b8ea6f55bb6271912c9].orig
+++ Prometheus::Alert::Rule[check_check_cfssl-multirootca_status_52832284a5fb8b8ea6f55bb6271912c9]

-    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_cfssl-multirootca_status))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
-    description        => NRPE CHECK: Check unit status of cfssl-multirootca
-    team               => observability
-    summary            => NRPE CHECK: Check unit status of cfssl-multirootca #page
-    dashboard          => TODO
-    runbook            => https://wikitech.wikimedia.org/wiki/PKI
-    def_label_whitelst => ['team', 'severity']
-    for                => 11m
-    ensure             => absent
-    expr               => (nagios_nrpe_check_result{alert_rule_hash="52832284a5fb8b8ea6f55bb6271912c9",check_name="check_check_cfssl-multirootca_status", status="CRITICAL", severity="page"} > 0) * on (instance) group_left (team) role_owner
-    instance           => ops
-    site               => eqiad
-    alert_name         => nrpe_Check_unit_status_of_cfssl_multirootca
-    group              => nrpechecks
-    severity           => info

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-cloud_wmnet_ca-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-cloud_wmnet_ca-certificate-expiry --cert-path /etc/cfssl/signers/cloud_wmnet_ca/ca/cloud_wmnet_ca.pem --outfile /var/lib/prometheus/node.d/cloud_wmnet_ca_intermediate.prom

Cfssl::Ocsp[discovery2026]

Parameters differences:

--- Cfssl::Ocsp[discovery2026].orig
+++ Cfssl::Ocsp[discovery2026]

-    listen_addr        => 127.0.0.1
-    log_level          => info
-    ocsprefresh_update => True
-    listen_port        => 10010
-    common_name        => pki1001.eqiad.wmnet
-    additional_names   => []
-    refresh_interval   => 96h
-    ca_file            => /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
-    db_driver          => mysql
-    db_conf_file       => /etc/cfssl/db.conf

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-puppet_rsa-certificate-expiry.timer]']

Class[Profile::Puppet::Agent]

Parameters differences:

--- Class[Profile::Puppet::Agent].orig
+++ Class[Profile::Puppet::Agent]

@@
-    dns_alt_names => ['pki.discovery.wmnet']
+    dns_alt_names => []

Httpd::Mod_conf[status]

Parameters differences:

--- Httpd::Mod_conf[status].orig
+++ Httpd::Mod_conf[status]

-    loadfile => status.load
-    mod      => status
-    ensure   => present

Prometheus::Node_textfile[prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-aux_front_proxy-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-aux_front_proxy-certificate-expiry --cert-path /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem --outfile /var/lib/prometheus/node.d/aux_front_proxy_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

File[/var/log/cfssl-ocsprefresh-dse]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-dse].orig
+++ File[/var/log/cfssl-ocsprefresh-dse]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Nrpe::Monitor_service[check_certificate_expiry_syslog]

Parameters differences:

--- Nrpe::Monitor_service[check_certificate_expiry_syslog].orig
+++ Nrpe::Monitor_service[check_certificate_expiry_syslog]

-    notes_url                   => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description                 => Check to ensure the signer certificate is valid CA: syslog
-    nrpe_command                => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem
-    retry_interval              => 1
-    timeout                     => 10
-    migration_task              => T350694
-    alertmanager_team           => observability
-    sudo_user                   => root
-    nrpe2nodexp_parse_perf_data => False
-    critical                    => False
-    retries                     => 3
-    ensure                      => present
-    enable_nrpe2nodexp          => False
-    enable_icinga_check         => True
-    contact_group               => admins
-    check_interval              => 1

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_wikikube]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_wikikube command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_wikikube
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "d2a76a31e44e204e2d4788a2698d0e6c" --timeout 10 --check-command "check_check_certificate_expiry_wikikube"

Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_zuul_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label zuul -profile ocsp /etc/cfssl/csr/OCSP_zuul_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_zuul_pki1001_eqiad_wmnet

Systemd::Service[cfssl-ocsprefresh-wikikube_staging]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-wikikube_staging].orig
+++ Systemd::Service[cfssl-ocsprefresh-wikikube_staging]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-wikikube_staging.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-mlserve_front_proxy-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-cloud-wmnet-ca-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Service[cfssl-ocsprefresh-dse_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-dse_front_proxy].orig
+++ Systemd::Service[cfssl-ocsprefresh-dse_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@kafka.service (cfssl-ocspserve@kafka)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@kafka]']
-    command     => /bin/systemctl daemon-reload

File[/usr/local/sbin/cfssl-certs]

Parameters differences:

--- File[/usr/local/sbin/cfssl-certs].orig
+++ File[/usr/local/sbin/cfssl-certs]

-    mode   => 0500
-    source => puppet:///modules/cfssl/cfssl_certs.py
-    ensure => file
-    owner  => root
-    group  => root

Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer].orig
+++ Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/usr/local/bin/prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-debmonitor-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-debmonitor-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Systemd::Unit[cfssl-ocspserve@kafka]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@kafka].orig
+++ Systemd::Unit[cfssl-ocspserve@kafka]

-    override          => False
-    unit              => cfssl-ocspserve@kafka
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Systemd::Syslog[cfssl-ocsprefresh-network_devices]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-network_devices].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-network_devices]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_puppet_rsa_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube-certificate-expiry]

-    ensure => present

Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_front_proxy.service (cfssl-ocspserve@mlserve_front_proxy)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@mlserve_front_proxy]']
-    command     => /bin/systemctl daemon-reload

Systemd::Service[nrpe2nodexp-check_cfssl-multirootca_status]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_cfssl-multirootca_status].orig
+++ Systemd::Service[nrpe2nodexp-check_cfssl-multirootca_status]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_cfssl-multirootca_status.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_aux.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_zuul]

Parameters differences:

--- Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_zuul].orig
+++ Monitoring::Exported_nagios_service[pki1001 check_certificate_expiry_zuul]

-    max_check_attempts     => 3
-    notes_url              => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    active_checks_enabled  => 1
-    retry_interval         => 1
-    is_volatile            => 0
-    check_period           => 24x7
-    check_freshness        => 0
-    passive_checks_enabled => 1
-    contact_groups         => admins
-    check_command          => nrpe_check!check_check_certificate_expiry_zuul!10
-    host_name              => pki1001
-    notifications_enabled  => 1
-    notification_interval  => 0
-    notification_options   => c,r,f
-    servicegroups          => pki_eqiad
-    ensure                 => present
-    notification_period    => 24x7
-    service_description    => Check to ensure the signer certificate is valid CA: zuul
-    check_interval         => 1

Cfssl::Signer[mlserve_front_proxy]

Parameters differences:

--- Cfssl::Signer[mlserve_front_proxy].orig
+++ Cfssl::Signer[mlserve_front_proxy]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDtzCCAxigAwIBAgIUIw4+rszPiPmnvGoMBfrD29oWNKcwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjMwMTI1MTY1NDAwWhcNMjgwMTI0MTY1NDAwWjCB
gTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xIjAgBgNVBAoT
GVdpa2ltZWRpYSBGb3VuZGF0aW9uLCBJbmMxGDAWBgNVBAsTD1NSRSBGb3VuZGF0
aW9uczEcMBoGA1UEAwwTbWxzZXJ2ZV9mcm9udF9wcm94eTCBmzAQBgcqhkjOPQIB
BgUrgQQAIwOBhgAEATdxtFPSx+kYYz4a6PyKfBi000SHiFxHSQqS71Bs13jbumD2
h6uPdTyD3dT79AdxQVzoer7inVQZM1vz5ZioLN0mAVH9OdSm8NLPpy9CAjT/2puk
6PZWtowGmcoOkXeZeZDIUOYam0f4udjmot9TDQPF07pSqABlhz1ejSC3AKOJDym+
o4IBDDCCAQgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYD
VR0OBBYEFDoU1EzaIZxR2ktTe35M8ILp07mdMB8GA1UdIwQYMBaAFDutonHmNL0b
/IC/NXGDkdDvaRM2MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDov
L3BraS5kaXNjb3Zlcnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9v
dF9DQTBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5l
dC9jcmwvV2lraW1lZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwA
MIGIAkIBsRpAWU0SxP3lwtUrriS8Dtal1vh2vfBMUzvx8hzjHGSYCg3xlG2cfnXN
lFIhsQaWUmiJFZg8m+rCdYNkUMsdpeACQgCCHUls+Tf5Kcc756qs2iC2JSf2yd2U
EM7VAJqZRVG9HrCUnzDLJT7bIQswE6i/O1zNhKjYV9xgd6LW+XCF0cVB7A==
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/mlserve_front_proxy
-    db_host          => localhost
-    default_usages   => ['signing', 'key encipherment', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => nosecret

-    ca_file          => /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}}
-    ca_key_file      => /etc/cfssl/signers/mlserve_front_proxy/ca/mlserve_front_proxy-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/mlserve_front_proxy
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service (prometheus-node-textfile-prometheus-check-kafka-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Unit[cfssl-ocspserve@wikikube_front_proxy]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@wikikube_front_proxy].orig
+++ Systemd::Unit[cfssl-ocspserve@wikikube_front_proxy]

-    override          => False
-    unit              => cfssl-ocspserve@wikikube_front_proxy
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Sudo::User[nrpe_certificate_check_cloud_wmnet_ca]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_cloud_wmnet_ca].orig
+++ Sudo::User[nrpe_certificate_check_cloud_wmnet_ca]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_cloud_wmnet_ca

File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

Parameters differences:

--- File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer].orig
+++ File[/lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer)]

Content differences:

--- /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer.orig
+++ /lib/systemd/system/prometheus-node-textfile-prometheus-check-aux-certificate-expiry.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
-
-[Timer]
-Unit=prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=daily
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Systemd::Service[cfssl-ocspserve@wikikube_staging_front_proxy]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@wikikube_staging_front_proxy].orig
+++ Systemd::Service[cfssl-ocspserve@wikikube_staging_front_proxy]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Monitoring::Service[check_certificate_expiry_wikikube_staging]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_wikikube_staging].orig
+++ Monitoring::Service[check_certificate_expiry_wikikube_staging]

-    check_command  => nrpe_check!check_check_certificate_expiry_wikikube_staging!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: wikikube_staging
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-aux-certificate-expiry]
-    ensure   => present
-    priority => 40

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer (nrpe2nodexp-check_certificate_expiry_wikikube_staging.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_mlserve_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]
-    ensure   => present
-    priority => 40

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-dse-front-proxy-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-dse_front_proxy-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_front_proxy_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Cfssl::Cert[OCSP_discovery2026_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_discovery2026_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_discovery2026_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => discovery2026
-    notify          => Service[cfssl-ocspserve@discovery2026]
-    profile         => ocsp

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_debmonitor.service (nrpe2nodexp-check_certificate_expiry_debmonitor.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse.prom]

Parameters differences:

--- File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse.prom].orig
+++ File[/var/lib/prometheus/node.d/check_check_certificate_expiry_dse.prom]

-    owner  => root
-    group  => root
-    ensure => absent

Systemd::Timer[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

Parameters differences:

--- Systemd::Timer[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry].orig
+++ Systemd::Timer[prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'daily'}]
-    unit_name          => prometheus-node-textfile-prometheus-check-cassandra-certificate-expiry.service

Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Systemd::Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-zuul-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Cfssl::Signer[kafka]

Parameters differences:

--- Cfssl::Signer[kafka].orig
+++ Cfssl::Signer[kafka]

-    listen_addr      => pki1001.eqiad.wmnet
-    ca_cert_content  => -----BEGIN CERTIFICATE-----
MIIDqDCCAwmgAwIBAgIUTWT2navXkMW9fz3oUB7Fc6azbKcwCgYIKoZIzj0EAwQw
gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
dGVybmFsX1Jvb3RfQ0EwHhcNMjExMDI4MTMwNjAwWhcNMjYxMDI3MTMwNjAwWjBz
MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
b25zMQ4wDAYDVQQDEwVrYWZrYTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAScI
AVY36upnobdfvpQJ7Y5uefRAv0OsdtR++HEqm2kTatOG4BJTdjdBv3+gyd3rJccd
DEifyU1EcxVVXjjXzqdHADiJ+Zol5mwexbnrpF8JDBiJv7ntNamdr7Xjv4kw8Tkp
kgl70aFalPLjpwjDNyrm2ACxPmHxK8EOu7eXb8RImqeVo4IBDDCCAQgwDgYDVR0P
AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFGIY/nB0tTtl
RGdO5J4ck+RM8p8rMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2MFYG
CCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zlcnku
d21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8EQzBB
MD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1lZGlh
X0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBv8ZMP7g8aPkc
tcrO4rXcBkhFIWH9+4H4iTbuSBtjVtUXdsRW++IU89BjVVKQxv/4ZDm8hlpd+vJU
b9xj3WUpi8cCQgFpjYqKVM+I5eRpIjhWoPxognJtGI3626wAOpV2CPauciD51gP3
up2xe36OG3Z8XDcbNGoNiG3505+af9zBrt3c4g==
-----END CERTIFICATE-----

-    default_ocsp_url => http://pki.discovery.wmnet/ocsp/kafka
-    db_host          => localhost
-    default_usages   => ['digital signature', 'key encipherment', 'server auth', 'client auth']
-    db_name          => cfssl
-    auth_keys        => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}, 'k8s_staging': {'key': 'ddddccccbbbbaaaa', 'type': 'standard'}, 'k8s_wikikube': {'key': 'ddddccccbbbbaaab', 'type': 'standard'}, 'k8s_mlserve': {'key': 'bbbbccccddddaaaa', 'type': 'standard'}, 'k8s_mlstaging': {'key': 'ccccbbbbaaaadddd', 'type': 'standard'}, 'k8s_dse': {'key': 'bbbbaaaaddddcccc', 'type': 'standard'}, 'k8s_aux': {'key': 'ffffffffffffffff', 'type': 'standard'}}
-    manage_services  => False
-    ca_key_content   => 
-    ca_file          => /etc/cfssl/signers/kafka/ca/kafka.pem
-    profiles         => {'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}, 'server': {'usages': ['digital signature', 'key encipherment', 'server auth'], 'expiry': '672h'}, 'kafka_11': {'expiry': '8760h'}}
-    ca_key_file      => /etc/cfssl/signers/kafka/ca/kafka-key.pem
-    db_driver        => sqlite3
-    default_expiry   => 672h
-    default_crl_url  => http://pki.discovery.wmnet/crl/kafka
-    log_level        => info
-    serve_ensure     => absent
-    serve_service    => cfssl-multirootca
-    listen_port      => 8888
-    manage_db        => False
-    db_user          => cfssl
-    db_pass          => changeme
-    db_conf_file     => /etc/cfssl/db.conf
-    default_auth_key => default_auth

File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_wikikube_pki1001_eqiad_wmnet.pem]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

File[/etc/cfssl/signers/mlserve]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve].orig
+++ File[/etc/cfssl/signers/mlserve]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/usr/local/bin/prometheus-check-dse-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-dse-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-dse-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

File[/etc/sudoers.d/nrpe_certificate_check_dse]

Parameters differences:

--- File[/etc/sudoers.d/nrpe_certificate_check_dse].orig
+++ File[/etc/sudoers.d/nrpe_certificate_check_dse]

-    owner  => root
-    group  => root
-    ensure => absent

Profile::Pki::Multirootca::Monitoring[wikikube_staging]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[wikikube_staging].orig
+++ Profile::Pki::Multirootca::Monitoring[wikikube_staging]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem
-    intermediate => wikikube_staging

File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet.csr]

-    mode   => 0440
-    owner  => root
-    group  => root
-    ensure => file

Exec[renew certificate - OCSP_discovery_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_discovery_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_discovery_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_discovery_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery_pki1001_eqiad_wmnet

File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging.service (cfssl-ocsprefresh-wikikube_staging.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-wikikube_staging.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - wikikube_staging
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_wikikube_staging_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/wikikube_staging/ca/wikikube_staging.pem --responses-file /etc/cfssl/ocsp/wikikube_staging.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@wikikube_staging' wikikube_staging

Systemd::Unit[cfssl-ocspserve@cloud_wmnet_ca]

Parameters differences:

--- Systemd::Unit[cfssl-ocspserve@cloud_wmnet_ca].orig
+++ Systemd::Unit[cfssl-ocspserve@cloud_wmnet_ca]

-    override          => False
-    unit              => cfssl-ocspserve@cloud_wmnet_ca
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => True
-    override_filename => puppet-override.conf

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer (prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[prometheus-node-textfile-prometheus-check-dse-certificate-expiry.timer]']

Systemd::Service[nrpe2nodexp-check_certificate_expiry_etcd]

Parameters differences:

--- Systemd::Service[nrpe2nodexp-check_certificate_expiry_etcd].orig
+++ Systemd::Service[nrpe2nodexp-check_certificate_expiry_etcd]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[nrpe2nodexp-check_certificate_expiry_etcd.service]
-    monitoring_critical      => False
-    ensure                   => absent
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Profile::Pki::Multirootca::Monitoring[discovery2026]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[discovery2026].orig
+++ Profile::Pki::Multirootca::Monitoring[discovery2026]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/discovery2026/ca/discovery2026.pem
-    intermediate => discovery2026

File[/etc/cfssl/signers/wikikube/ca]

Parameters differences:

--- File[/etc/cfssl/signers/wikikube/ca].orig
+++ File[/etc/cfssl/signers/wikikube/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/lib/systemd/system/wmf_auto_restart_apache2.timer]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_apache2.timer].orig
+++ File[/lib/systemd/system/wmf_auto_restart_apache2.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for wmf_auto_restart_apache2.timer (wmf_auto_restart_apache2.timer)]

Content differences:

--- /lib/systemd/system/wmf_auto_restart_apache2.timer.orig
+++ /lib/systemd/system/wmf_auto_restart_apache2.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of wmf_auto_restart_apache2.service
-
-[Timer]
-Unit=wmf_auto_restart_apache2.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 22:8:00
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.service (nrpe2nodexp-check_certificate_expiry_mlserve.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_mlserve
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "bfd2f7c6497e1da6323bef48d24f9e8e" --timeout 10 --check-command "check_check_certificate_expiry_mlserve"

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_network_devices.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_network_devices.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer].orig
+++ File[/lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for wmf_auto_restart_apache-htcacheclean.timer (wmf_auto_restart_apache-htcacheclean.timer)]

Content differences:

--- /lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer.orig
+++ /lib/systemd/system/wmf_auto_restart_apache-htcacheclean.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Periodic execution of wmf_auto_restart_apache-htcacheclean.service
-
-[Timer]
-Unit=wmf_auto_restart_apache-htcacheclean.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 3:51:00
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

Class[Cumin::Selector]

Parameters differences:

--- Class[Cumin::Selector].orig
+++ Class[Cumin::Selector]

@@
-    cluster => pki
+    cluster => insetup

File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service (cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service
@@ -1,8 +0,0 @@
-[Unit]
-Description=OCSP Refresh job - Wikimedia_Internal_Root_CA
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=root
-ExecStart=/usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/ssl/Wikimedia_Internal_Root_CA.pem --responses-file /etc/cfssl/ocsp/Wikimedia_Internal_Root_CA.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@Wikimedia_Internal_Root_CA' Wikimedia_Internal_Root_CA

File[/usr/local/bin/prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- File[/usr/local/bin/prometheus-check-mlserve-certificate-expiry].orig
+++ File[/usr/local/bin/prometheus-check-mlserve-certificate-expiry]

-    mode   => 0555
-    source => puppet:///modules/prometheus/check_certificate_expiry.py
-    ensure => present
-    owner  => root
-    group  => root

Systemd::Service[wmf_auto_restart_apache2]

Parameters differences:

--- Systemd::Service[wmf_auto_restart_apache2].orig
+++ Systemd::Service[wmf_auto_restart_apache2]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[wmf_auto_restart_apache2.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

File[/srv/cfssl/bundles/wikikube_staging.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/wikikube_staging.pem].orig
+++ File[/srv/cfssl/bundles/wikikube_staging.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/wikikube_staging.pem.orig
+++ /srv/cfssl/bundles/wikikube_staging.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDsTCCAxSgAwIBAgIUKJGxrsUkuGnKTwrJIdYlm1ZK6uMwCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB+
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMRkwFwYDVQQDDBB3aWtpa3ViZV9zdGFnaW5nMIGbMBAGByqGSM49AgEGBSuB
-BAAjA4GGAAQBJQPiRDYxLnr33KdzugCHk21yjDhyRHMrAIJ0qGmasdcMNZpK9P9u
-6ISJRfTC73WiKOSSWBuJAhsdK2Y7hIoUOikAexL5MOVOFAK8MtWXx6j7MmuuPGnC
-MIyIk1pqxzoacZWJ8uJe/WGw/Udd/RPxAfsxN8loKKT0+zs3WzGw63saO6yjggEM
-MIIBCDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4E
-FgQU8bcT1hszDpGqcobdFXNOugsbu0MwHwYDVR0jBBgwFoAUO62iceY0vRv8gL81
-cYOR0O9pEzYwVgYIKwYBBQUHAQEESjBIMEYGCCsGAQUFBzABhjpodHRwOi8vcGtp
-LmRpc2NvdmVyeS53bW5ldC9vY3NwL1dpa2ltZWRpYV9JbnRlcm5hbF9Sb290X0NB
-MEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9wa2kuZGlzY292ZXJ5LndtbmV0L2Ny
-bC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTAKBggqhkjOPQQDBAOBigAwgYYC
-QTKbWZ4u9V6ei9rgB4XXyyVEzIZMgVCdwuytcmqEaB9ZavqjYsdrgTOsgcy2Jw1C
-id1Sw/9g5YpcZBLaXh52CuNVAkFnnXo7+fe5kgOs2vTIsbIG4huh6ftI/8bmIdr2
-9FHm9FXlmSIDWQIn7Fq4TFLVmiatI/TdiGK+n3oT/st73jwn1A==
------END CERTIFICATE-----

Logrotate::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    ensure => present

File[/etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf]

Parameters differences:

--- File[/etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf].orig
+++ File[/etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for apache2.service (apache2-apache2-after-network-online-target)]

Content differences:

--- /etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf.orig
+++ /etc/systemd/system/apache2.service.d/apache2-after-network-online-target.conf
@@ -1,3 +0,0 @@
-[Unit]
-After=network-online.target
-Wants=network-online.target

Service[cfssl-ocspserve@dse]

Parameters differences:

--- Service[cfssl-ocspserve@dse].orig
+++ Service[cfssl-ocspserve@dse]

-    ensure => running
-    enable => True

Systemd::Service[cfssl-ocspserve@wikikube_staging]

Parameters differences:

--- Systemd::Service[cfssl-ocspserve@wikikube_staging].orig
+++ Systemd::Service[cfssl-ocspserve@wikikube_staging]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => True
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => service

Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service]

Parameters differences:

--- Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service].orig
+++ Systemd::Unit[nrpe2nodexp-check_certificate_expiry_cassandra.service]

-    override          => False
-    unit              => nrpe2nodexp-check_certificate_expiry_cassandra.service
-    require           => ['Class[Systemd]']
-    ensure            => absent
-    restart           => False
-    override_filename => puppet-override.conf

Systemd::Timer::Job[cfssl-ocsprefresh-syslog]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-syslog].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-syslog]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - syslog
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_syslog_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/syslog/ca/syslog.pem --responses-file /etc/cfssl/ocsp/syslog.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@syslog' syslog

Nrpe::Check[check_check_certificate_expiry_etcd]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_etcd].orig
+++ Nrpe::Check[check_check_certificate_expiry_etcd]

-    before    => Monitoring::Service[check_certificate_expiry_etcd]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/etcd/ca/etcd.pem

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-mlserve-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-mlserve-certificate-expiry --cert-path /etc/cfssl/signers/mlserve/ca/mlserve.pem --outfile /var/lib/prometheus/node.d/mlserve_intermediate.prom

Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer].orig
+++ Systemd::Unit[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer]

-    override          => False
-    unit              => cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@wikikube_staging_front_proxy.service (cfssl-ocspserve@wikikube_staging_front_proxy)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@wikikube_staging_front_proxy]']
-    command     => /bin/systemctl daemon-reload

Systemd::Service[cfssl-ocsprefresh-mlserve]

Parameters differences:

--- Systemd::Service[cfssl-ocsprefresh-mlserve].orig
+++ Systemd::Service[cfssl-ocsprefresh-mlserve]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[cfssl-ocsprefresh-mlserve.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry]

-    ensure => present

Service[nrpe2nodexp-check_certificate_expiry_network_devices.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_network_devices.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_network_devices.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_network_devices.timer (nrpe2nodexp-check_certificate_expiry_network_devices.timer)]']

Service[nrpe2nodexp-check_certificate_expiry_zuul.timer]

Parameters differences:

--- Service[nrpe2nodexp-check_certificate_expiry_zuul.timer].orig
+++ Service[nrpe2nodexp-check_certificate_expiry_zuul.timer]

-    provider => systemd
-    ensure   => stopped
-    enable   => False
-    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_zuul.timer (nrpe2nodexp-check_certificate_expiry_zuul.timer)]']

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-mlserve-certificate-expiry]
-    ensure   => present
-    priority => 40

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-debmonitor.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-debmonitor" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-debmonitor/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-mlserve_staging-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube.service (cfssl-ocsprefresh-wikikube.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Rsyslog::Conf[cfssl-ocsprefresh-zuul]

Parameters differences:

--- Rsyslog::Conf[cfssl-ocsprefresh-zuul].orig
+++ Rsyslog::Conf[cfssl-ocsprefresh-zuul]

-    mode     => 0444
-    require  => File[/var/log/cfssl-ocsprefresh-zuul]
-    ensure   => present
-    priority => 40

Exec[renew certificate - OCSP_discovery2026_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_discovery2026_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_discovery2026_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_discovery2026_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label discovery2026 -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet

Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

Parameters differences:

--- Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry].orig
+++ Systemd::Service[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry]

-    override                 => False
-    monitoring_enabled       => False
-    migration_task           => T407130
-    require                  => Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service]
-    monitoring_critical      => False
-    ensure                   => present
-    restart                  => False
-    service_params           => {}
-    monitoring_contact_group => admins
-    unit_type                => timer

Concat_fragment[main contacts]

Content differences:

--- main contacts.orig
+++ main contacts
@@ -1,3 +1,3 @@
 ---
-role::pki::multirootca:
+role::insetup::infrastructure_foundations_ferm:
 - Infrastructure Foundations

File[/etc/cfssl/ocsp/discovery.ocsp]

Parameters differences:

--- File[/etc/cfssl/ocsp/discovery.ocsp].orig
+++ File[/etc/cfssl/ocsp/discovery.ocsp]

-    owner  => root
-    group  => root
-    ensure => file

Httpd::Mod_conf[headers]

Parameters differences:

--- Httpd::Mod_conf[headers].orig
+++ Httpd::Mod_conf[headers]

-    loadfile => headers.load
-    mod      => headers
-    ensure   => present

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve_staging.service (nrpe2nodexp-check_certificate_expiry_mlserve_staging.service)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_mlserve_staging.service
@@ -1,11 +0,0 @@
-[Unit]
-Description=execution of nrpe2nodexp for the check_check_certificate_expiry_mlserve_staging command.
-Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-
-[Service]
-Type=oneshot
-User=nagios
-
-Group=prometheus-node-exporter
-SyslogIdentifier=nrpe2nodexp-check_certificate_expiry_mlserve_staging
-ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "7cff186656c3cabbca85b5b57d0c8679" --timeout 10 --check-command "check_check_certificate_expiry_mlserve_staging"

Service[cfssl-ocsprefresh-dse_front_proxy.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-dse_front_proxy.timer].orig
+++ Service[cfssl-ocsprefresh-dse_front_proxy.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-wikikube_staging_front_proxy.timer (cfssl-ocsprefresh-wikikube_staging_front_proxy.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-wikikube_staging_front_proxy.timer]']

Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-dse-certificate-expiry]

-    ensure => present

Nrpe::Check[check_check_certificate_expiry_mlserve_staging]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_mlserve_staging].orig
+++ Nrpe::Check[check_check_certificate_expiry_mlserve_staging]

-    before    => Monitoring::Service[check_certificate_expiry_mlserve_staging]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/mlserve_staging/ca/mlserve_staging.pem

Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-aux-certificate-expiry.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Cfssl::Cert[OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_mlserve_staging_front_proxy_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_staging_front_proxy]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => mlserve_staging_front_proxy
-    notify          => Service[cfssl-ocspserve@mlserve_staging_front_proxy]
-    profile         => ocsp

Sudo::User[nrpe_certificate_check_mlserve]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_mlserve].orig
+++ Sudo::User[nrpe_certificate_check_mlserve]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_mlserve

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_puppet_rsa].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_puppet_rsa]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-syslog-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-syslog-certificate-expiry --cert-path /etc/cfssl/signers/syslog/ca/syslog.pem --outfile /var/lib/prometheus/node.d/syslog_intermediate.prom

Monitoring::Service[check_certificate_expiry_discovery2026]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_discovery2026].orig
+++ Monitoring::Service[check_certificate_expiry_discovery2026]

-    check_command  => nrpe_check!check_check_certificate_expiry_discovery2026!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: discovery2026
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

Sudo::User[nrpe_certificate_check_wikikube_front_proxy]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_wikikube_front_proxy].orig
+++ Sudo::User[nrpe_certificate_check_wikikube_front_proxy]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_wikikube_front_proxy

Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse_front_proxy].orig
+++ Rsyslog::Conf[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

-    mode     => 0444
-    ensure   => absent
-    priority => 25

Service[cfssl-ocsprefresh-etcd.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-etcd.timer].orig
+++ Service[cfssl-ocsprefresh-etcd.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_aux_front_proxy.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_aux_front_proxy]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem

File[/etc/cfssl/signers/mlserve_staging/ca]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging/ca].orig
+++ File[/etc/cfssl/signers/mlserve_staging/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ Logrotate::Conf[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    ensure => present

Sudo::User[nrpe_certificate_check_puppet_rsa]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_puppet_rsa].orig
+++ Sudo::User[nrpe_certificate_check_puppet_rsa]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_puppet_rsa

Systemd::Timer[nrpe2nodexp-check_certificate_expiry_network_devices]

Parameters differences:

--- Systemd::Timer[nrpe2nodexp-check_certificate_expiry_network_devices].orig
+++ Systemd::Timer[nrpe2nodexp-check_certificate_expiry_network_devices]

-    splay              => 60
-    fixed_random_delay => True
-    ensure             => absent
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => nrpe2nodexp-check_certificate_expiry_network_devices.service

Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet refresh]

Parameters differences:

--- Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet refresh].orig
+++ Exec[Generate cert OCSP_dse_pki1001_eqiad_wmnet refresh]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    subscribe   => File[/etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr]
-    refreshonly => True
-    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label dse -profile ocsp /etc/cfssl/csr/OCSP_dse_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_dse_pki1001_eqiad_wmnet

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_network_devices
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem

Systemd::Syslog[cfssl-ocsprefresh-aux_front_proxy]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-aux_front_proxy].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-aux_front_proxy]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Cfssl::Cert[OCSP_wikikube_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_wikikube_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_wikikube_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-wikikube]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => wikikube
-    notify          => Service[cfssl-ocspserve@wikikube]
-    profile         => ocsp

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve-staging.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_mlserve_staging" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer (nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_certificate_expiry_aux_front_proxy.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
-
-[Timer]
-Unit=nrpe2nodexp-check_certificate_expiry_aux_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1min
-OnActiveSec=1s
-RandomizedDelaySec=60
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/signers/aux/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/aux/cfssl.conf].orig
+++ File[/etc/cfssl/signers/aux/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/aux/cfssl.conf.orig
+++ /etc/cfssl/signers/aux/cfssl.conf
@@ -1,81 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "672h",
-      "crl_url": "http://pki.discovery.wmnet/crl/aux",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/aux"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "service-account-management": {
-        "auth_key": "default_auth",
-        "expiry": "672h",
-        "usages": [
-          "digital signature",
-          "key encipherment"
-        ]
-      },
-      "prometheus": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

Exec[renew certificate - OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Exec[renew certificate - OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet].orig
+++ Exec[renew certificate - OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

-    environment => ['GODEBUG=x509ignoreCN=0']
-    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.pem -checkend 952200
-    require     => Exec[Generate cert OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]
-    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem -label mlserve_front_proxy -profile ocsp /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/ocsp/OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet

Prometheus::Node_textfile[prometheus-check-debmonitor-certificate-expiry]

Parameters differences:

--- Prometheus::Node_textfile[prometheus-check-debmonitor-certificate-expiry].orig
+++ Prometheus::Node_textfile[prometheus-check-debmonitor-certificate-expiry]

-    filesource     => puppet:///modules/prometheus/check_certificate_expiry.py
-    run_cmd        => /usr/local/bin/prometheus-check-debmonitor-certificate-expiry --cert-path /etc/cfssl/signers/debmonitor/ca/debmonitor.pem --outfile /var/lib/prometheus/node.d/debmonitor_intermediate.prom
-    user           => root
-    require        => ['Package[python3-cryptography]', 'Package[python3-prometheus-client]']
-    ensure         => present
-    extra_packages => []
-    environment    => {}
-    interval       => daily

Sudo::User[nrpe-check_check_certificate_expiry_aux_front_proxy]

Parameters differences:

--- Sudo::User[nrpe-check_check_certificate_expiry_aux_front_proxy].orig
+++ Sudo::User[nrpe-check_check_certificate_expiry_aux_front_proxy]

-    require    => ['Class[Sudo]']
-    tag        => nrpe::check
-    ensure     => present
-    privileges => ['ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/aux_front_proxy/ca/aux_front_proxy.pem']
-    user       => nagios

Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

Parameters differences:

--- Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer].orig
+++ Service[prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Service[cfssl-ocspserve@discovery]

Parameters differences:

--- Service[cfssl-ocspserve@discovery].orig
+++ Service[cfssl-ocspserve@discovery]

-    ensure => running
-    enable => True

Logrotate::Conf[cfssl-ocsprefresh-puppet_rsa]

Parameters differences:

--- Logrotate::Conf[cfssl-ocsprefresh-puppet_rsa].orig
+++ Logrotate::Conf[cfssl-ocsprefresh-puppet_rsa]

-    ensure => present

File[/etc/cfssl/signers/cassandra/ca/cassandra-key.pem]

Parameters differences:

--- File[/etc/cfssl/signers/cassandra/ca/cassandra-key.pem].orig
+++ File[/etc/cfssl/signers/cassandra/ca/cassandra-key.pem]

-    mode      => 0400
-    ensure    => file
-    show_diff => False
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-multirootca]

Content differences:

--- /etc/cfssl/signers/cassandra/ca/cassandra-key.pem.orig
+++ /etc/cfssl/signers/cassandra/ca/cassandra-key.pem
@@ -1 +0,0 @@
-nosecret

Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)].orig
+++ Exec[systemd daemon-reload for cfssl-ocspserve@mlserve_staging_front_proxy.service (cfssl-ocspserve@mlserve_staging_front_proxy)]

-    refreshonly => True
-    notify      => ['Service[cfssl-ocspserve@mlserve_staging_front_proxy]']
-    command     => /bin/systemctl daemon-reload

Monitoring::Service[check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_wikikube_front_proxy].orig
+++ Monitoring::Service[check_certificate_expiry_wikikube_front_proxy]

-    check_command  => nrpe_check!check_check_certificate_expiry_wikikube_front_proxy!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: wikikube_front_proxy
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

Systemd::Timer[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

Parameters differences:

--- Systemd::Timer[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA].orig
+++ Systemd::Timer[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]

-    splay              => 0
-    fixed_random_delay => False
-    ensure             => present
-    accuracy           => 15sec
-    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1h'}, {'interval': '1s', 'start': 'OnActiveSec'}]
-    unit_name          => cfssl-ocsprefresh-Wikimedia_Internal_Root_CA.service

Monitoring::Service[check_certificate_expiry_dse]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_dse].orig
+++ Monitoring::Service[check_certificate_expiry_dse]

-    check_command  => nrpe_check!check_check_certificate_expiry_dse!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: dse
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

Parameters differences:

--- Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer].orig
+++ Systemd::Unit[prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer]

-    override          => False
-    unit              => prometheus-node-textfile-prometheus-check-wikikube_staging-certificate-expiry.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf].orig
+++ File[/etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf.orig
+++ /etc/rsyslog.d/40-cfssl-ocsprefresh-aux-front-proxy.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "cfssl-ocsprefresh-aux_front_proxy" then {
-    action(
-        type="omfile" file="/var/log/cfssl-ocsprefresh-aux_front_proxy/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Profile::Pki::Multirootca::Monitoring[zuul]

Parameters differences:

--- Profile::Pki::Multirootca::Monitoring[zuul].orig
+++ Profile::Pki::Multirootca::Monitoring[zuul]

-    vhost        => pki.discovery.wmnet
-    ensure       => present
-    ca_file      => /etc/cfssl/signers/zuul/ca/zuul.pem
-    intermediate => zuul

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service (prometheus-node-textfile-prometheus-check-discovery2026-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

Parameters differences:

--- Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry].orig
+++ Systemd::Timer::Job[prometheus-node-textfile-prometheus-check-discovery-certificate-expiry]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Systemd timer to gather node metrics for prometheus-check-discovery-certificate-expiry
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'daily'}
-    logfile_perms             => all
-    command                   => /usr/local/bin/prometheus-check-discovery-certificate-expiry --cert-path /etc/cfssl/signers/discovery/ca/discovery.pem --outfile /var/lib/prometheus/node.d/discovery_intermediate.prom

Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_syslog_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Rsyslog::Conf[wmf_auto_restart_apache2]

Parameters differences:

--- Rsyslog::Conf[wmf_auto_restart_apache2].orig
+++ Rsyslog::Conf[wmf_auto_restart_apache2]

-    mode     => 0444
-    require  => File[/var/log/wmf_auto_restart_apache2]
-    ensure   => present
-    priority => 40

Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026]

Parameters differences:

--- Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026].orig
+++ Systemd::Timer::Job[cfssl-ocsprefresh-discovery2026]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => OCSP Refresh job - discovery2026
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnUnitInactiveSec', 'interval': '1h'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/cfssl-ocsprefresh --update --responder-cert /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet.pem --responder-key /etc/cfssl/ssl/ocsp/OCSP_discovery2026_pki1001_eqiad_wmnet-key.pem --ca-file /etc/cfssl/signers/discovery2026/ca/discovery2026.pem --responses-file /etc/cfssl/ocsp/discovery2026.ocsp --dbconfig /etc/cfssl/db.conf --restart-service 'cfssl-ocspserve@discovery2026' discovery2026

Cfssl::Cert[OCSP_kafka_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_kafka_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_kafka_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-kafka]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => kafka
-    notify          => Service[cfssl-ocspserve@kafka]
-    profile         => ocsp

Monitoring::Service[check_certificate_expiry_discovery]

Parameters differences:

--- Monitoring::Service[check_certificate_expiry_discovery].orig
+++ Monitoring::Service[check_certificate_expiry_discovery]

-    check_command  => nrpe_check!check_check_certificate_expiry_discovery!10
-    notes_url      => https://wikitech.wikimedia.org/wiki/PKI/CA_Operations
-    description    => Check to ensure the signer certificate is valid CA: discovery
-    config_dir     => /etc/nagios
-    retry_interval => 1
-    freshness      => 36000
-    migration_task => T350694
-    critical       => False
-    retries        => 3
-    ensure         => present
-    host           => pki1001
-    passive        => False
-    contact_group  => admins
-    check_interval => 1

Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_staging_front_proxy.service (cfssl-ocsprefresh-mlserve_staging_front_proxy.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg]

Parameters differences:

--- File[/etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg].orig
+++ File[/etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg]

-    mode    => 0444
-    require => Package[nagios-nrpe-server]
-    tag     => nrpe::check
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[nagios-nrpe-server]

Content differences:

--- /etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg.orig
+++ /etc/nagios/nrpe.d/check_check_certificate_expiry_syslog.cfg
@@ -1,2 +0,0 @@
-# File generated by puppet. DO NOT edit by hand
-command[check_check_certificate_expiry_syslog]=/usr/bin/sudo /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/syslog/ca/syslog.pem

Service[cfssl-ocsprefresh-puppet_rsa.timer]

Parameters differences:

--- Service[cfssl-ocsprefresh-puppet_rsa.timer].orig
+++ Service[cfssl-ocsprefresh-puppet_rsa.timer]

-    provider => systemd
-    ensure   => running
-    enable   => True

Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)]

Parameters differences:

--- Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)].orig
+++ Exec[systemd daemon-reload for prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service (prometheus-node-textfile-prometheus-check-wikikube_staging_front_proxy-certificate-expiry.service)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/signers/mlserve_staging/cfssl.conf]

Parameters differences:

--- File[/etc/cfssl/signers/mlserve_staging/cfssl.conf].orig
+++ File[/etc/cfssl/signers/mlserve_staging/cfssl.conf]

-    mode      => 0440
-    ensure    => present
-    show_diff => False
-    owner     => root
-    group     => root

Content differences:

--- /etc/cfssl/signers/mlserve_staging/cfssl.conf.orig
+++ /etc/cfssl/signers/mlserve_staging/cfssl.conf
@@ -1,81 +0,0 @@
-{
-  "auth_keys": {
-    "default_auth": {
-      "key": "aaaabbbbccccdddd",
-      "type": "standard"
-    },
-    "k8s_staging": {
-      "key": "ddddccccbbbbaaaa",
-      "type": "standard"
-    },
-    "k8s_wikikube": {
-      "key": "ddddccccbbbbaaab",
-      "type": "standard"
-    },
-    "k8s_mlserve": {
-      "key": "bbbbccccddddaaaa",
-      "type": "standard"
-    },
-    "k8s_mlstaging": {
-      "key": "ccccbbbbaaaadddd",
-      "type": "standard"
-    },
-    "k8s_dse": {
-      "key": "bbbbaaaaddddcccc",
-      "type": "standard"
-    },
-    "k8s_aux": {
-      "key": "ffffffffffffffff",
-      "type": "standard"
-    }
-  },
-  "signing": {
-    "default": {
-      "auth_key": "default_auth",
-      "usages": [
-        "signing",
-        "key encipherment",
-        "client auth"
-      ],
-      "expiry": "72h",
-      "crl_url": "http://pki.discovery.wmnet/crl/mlserve_staging",
-      "ocsp_url": "http://pki.discovery.wmnet/ocsp/mlserve_staging"
-    },
-    "profiles": {
-      "ocsp": {
-        "auth_key": "default_auth",
-        "expiry": "43800h",
-        "usages": [
-          "digital signature",
-          "ocsp signing"
-        ]
-      },
-      "server": {
-        "auth_key": "default_auth",
-        "expiry": "72h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "server auth"
-        ]
-      },
-      "service-account-management": {
-        "auth_key": "default_auth",
-        "expiry": "72h",
-        "usages": [
-          "digital signature",
-          "key encipherment"
-        ]
-      },
-      "prometheus": {
-        "auth_key": "default_auth",
-        "expiry": "8760h",
-        "usages": [
-          "digital signature",
-          "key encipherment",
-          "client auth"
-        ]
-      }
-    }
-  }
-}

Systemd::Unit[cfssl-gc-expired-certs.timer]

Parameters differences:

--- Systemd::Unit[cfssl-gc-expired-certs.timer].orig
+++ Systemd::Unit[cfssl-gc-expired-certs.timer]

-    override          => False
-    unit              => cfssl-gc-expired-certs.timer
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)].orig
+++ Exec[systemd daemon-reload for cfssl-ocsprefresh-dse.timer (cfssl-ocsprefresh-dse.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload
-    before      => ['Service[cfssl-ocsprefresh-dse.timer]']

File[/srv/cfssl/bundles/wikikube.pem]

Parameters differences:

--- File[/srv/cfssl/bundles/wikikube.pem].orig
+++ File[/srv/cfssl/bundles/wikikube.pem]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /srv/cfssl/bundles/wikikube.pem.orig
+++ /srv/cfssl/bundles/wikikube.pem
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqzCCAwygAwIBAgIUWXrkQs5GEdgVcV7/XAEZOXQLYlowCgYIKoZIzj0EAwQw
-gZwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSIwIAYDVQQKExlXaWtpbWVkaWEgRm91bmRhdGlvbiwgSW5j
-MRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEjMCEGA1UEAwwaV2lraW1lZGlhX0lu
-dGVybmFsX1Jvb3RfQ0EwHhcNMjIxMjEyMTQyOTAwWhcNMjcxMjExMTQyOTAwWjB2
-MQswCQYDVQQGEwJVUzEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEiMCAGA1UEChMZ
-V2lraW1lZGlhIEZvdW5kYXRpb24sIEluYzEYMBYGA1UECxMPU1JFIEZvdW5kYXRp
-b25zMREwDwYDVQQDEwh3aWtpa3ViZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAE
-AX4fMTh3NrBZlCMop5eKr6F/RXTefrSSdu6DE39OOKTTdYM3TxK8tPmTDm9EE+XT
-4rO+VHuaIVVirgB2JQtla8oZAZb60Pw8v9BlJ1JLLK9vpWA9Vce7DKmMNxIWK9GA
-YIUQufjHVD2eibYJsK54NGkBe3frhPhwayIvzJ3gGO34GRaRo4IBDDCCAQgwDgYD
-VR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFAaU1Sae
-B9+FDd+SrIADU8yIo+xJMB8GA1UdIwQYMBaAFDutonHmNL0b/IC/NXGDkdDvaRM2
-MFYGCCsGAQUFBwEBBEowSDBGBggrBgEFBQcwAYY6aHR0cDovL3BraS5kaXNjb3Zl
-cnkud21uZXQvb2NzcC9XaWtpbWVkaWFfSW50ZXJuYWxfUm9vdF9DQTBKBgNVHR8E
-QzBBMD+gPaA7hjlodHRwOi8vcGtpLmRpc2NvdmVyeS53bW5ldC9jcmwvV2lraW1l
-ZGlhX0ludGVybmFsX1Jvb3RfQ0EwCgYIKoZIzj0EAwQDgYwAMIGIAkIBFZVjRbh3
-GaouRaz9IPef3q+9s+TleKGby7nJQ6z71M3rpJIsHr9lncr/9GPq5v5cHDYOHmgK
-GBupTY7FNMwL8aACQgCgoDP6PO23Dw6tuswLIbeY+o5l3K8R5L3RS1DO59OXXV2f
-9FmoJNLgGXgP87rOkFW1fn9/QcvX85zD0urkq8gNjg==
------END CERTIFICATE-----

File[/var/log/cfssl-ocsprefresh-syslog]

Parameters differences:

--- File[/var/log/cfssl-ocsprefresh-syslog].orig
+++ File[/var/log/cfssl-ocsprefresh-syslog]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

Sudo::User[nrpe_certificate_check_syslog]

Parameters differences:

--- Sudo::User[nrpe_certificate_check_syslog].orig
+++ Sudo::User[nrpe_certificate_check_syslog]

-    require    => ['Class[Sudo]']
-    privileges => []
-    ensure     => absent
-    user       => nrpe_certificate_check_syslog

Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/OCSP_discovery_pki1001_eqiad_wmnet.csr]

-    hosts       => []
-    names       => []
-    ensure      => present
-    key         => {'algo': 'ecdsa', 'size': 256}
-    common_name => pki1001.eqiad.wmnet

Nrpe::Check[check_check_certificate_expiry_wikikube_front_proxy]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_wikikube_front_proxy].orig
+++ Nrpe::Check[check_check_certificate_expiry_wikikube_front_proxy]

-    before    => Monitoring::Service[check_certificate_expiry_wikikube_front_proxy]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/wikikube_front_proxy/ca/wikikube_front_proxy.pem

File[/etc/apache2/sites-enabled]

Parameters differences:

--- File[/etc/apache2/sites-enabled].orig
+++ File[/etc/apache2/sites-enabled]

-    owner   => root
-    recurse => True
-    purge   => True
-    mode    => 0755
-    require => Package[apache2]
-    ensure  => directory
-    group   => root
-    notify  => Service[apache2]

File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

Parameters differences:

--- File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry].orig
+++ File[/etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry]

-    mode   => 0444
-    owner  => root
-    group  => root
-    ensure => present

Content differences:

--- /etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry.orig
+++ /etc/logrotate.d/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry
@@ -1,12 +0,0 @@
-# logrotate(8) config for prometheus-node-textfile-prometheus-check-syslog-certificate-expiry
-
-/var/log/prometheus-node-textfile-prometheus-check-syslog-certificate-expiry/*.log {
-    daily
-    copytruncate
-    missingok
-    compress
-    delaycompress
-    notifempty
-    rotate 15
-    size 256M
-}

File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer]

Parameters differences:

--- File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer].orig
+++ File[/lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_cfssl-multirootca_status.timer (nrpe2nodexp-check_cfssl-multirootca_status.timer)]

Content differences:

--- /lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer.orig
+++ /lib/systemd/system/nrpe2nodexp-check_cfssl-multirootca_status.timer
@@ -1,14 +0,0 @@
-[Unit]
-Description=Periodic execution of nrpe2nodexp-check_cfssl-multirootca_status.service
-
-[Timer]
-Unit=nrpe2nodexp-check_cfssl-multirootca_status.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=5min
-OnActiveSec=1s
-RandomizedDelaySec=300
-FixedRandomDelay=true
-
-[Install]
-WantedBy=multi-user.target

File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

Parameters differences:

--- File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr].orig
+++ File[/etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr]

-    mode   => 0400
-    owner  => root
-    group  => root
-    ensure => file

Content differences:

--- /etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr.orig
+++ /etc/cfssl/csr/OCSP_discovery2026_pki1001_eqiad_wmnet.csr
@@ -1,13 +0,0 @@
-{
-  "CN": "pki1001.eqiad.wmnet",
-  "hosts": [
-    "pki1001.eqiad.wmnet"
-  ],
-  "key": {
-    "algo": "ecdsa",
-    "size": 256
-  },
-  "names": [
-
-  ]
-}

Cfssl::Cert[OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

Parameters differences:

--- Cfssl::Cert[OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet].orig
+++ Cfssl::Cert[OCSP_mlserve_front_proxy_pki1001_eqiad_wmnet]

-    names           => []
-    provide_chain   => False
-    auto_renew      => True
-    mode            => 0740
-    before_services => []
-    before          => Systemd::Timer::Job[cfssl-ocsprefresh-mlserve_front_proxy]
-    key             => {'algo': 'ecdsa', 'size': 256}
-    group           => root
-    signer_config   => {'config_file': '/etc/cfssl/client-cfssl.conf'}
-    hosts           => []
-    owner           => root
-    tls_key         => /var/lib/puppet/ssl/private_keys/pki1001.eqiad.wmnet.pem
-    renew_seconds   => 952200
-    tls_cert        => /etc/cfssl/mutual_tls_client_cert.pem
-    common_name     => pki1001.eqiad.wmnet
-    outdir          => /etc/cfssl/ssl/ocsp
-    notify_services => []
-    ensure          => present
-    environment     => ['GODEBUG=x509ignoreCN=0']
-    label           => mlserve_front_proxy
-    notify          => Service[cfssl-ocspserve@mlserve_front_proxy]
-    profile         => ocsp

Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)].orig
+++ Exec[systemd daemon-reload for nrpe2nodexp-check_certificate_expiry_mlserve.timer (nrpe2nodexp-check_certificate_expiry_mlserve.timer)]

-    refreshonly => True
-    command     => /bin/systemctl daemon-reload

Systemd::Syslog[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

Parameters differences:

--- Systemd::Syslog[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry].orig
+++ Systemd::Syslog[prometheus-node-textfile-prometheus-check-cloud_wmnet_ca-certificate-expiry]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Exec[ensure_present_mod_headers]

Parameters differences:

--- Exec[ensure_present_mod_headers].orig
+++ Exec[ensure_present_mod_headers]

-    require => Package[apache2]
-    creates => /etc/apache2/mods-enabled/headers.load
-    notify  => Service[apache2]
-    command => /usr/sbin/a2enmod headers

Systemd::Timer::Job[wmf_auto_restart_apache-htcacheclean]

Parameters differences:

--- Systemd::Timer::Job[wmf_auto_restart_apache-htcacheclean].orig
+++ Systemd::Timer::Job[wmf_auto_restart_apache-htcacheclean]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Auto restart job: apache-htcacheclean
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    require                   => File[/usr/local/sbin/wmf-auto-restart]
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 3:51:00'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/wmf-auto-restart -s apache-htcacheclean

Nrpe::Check[check_check_certificate_expiry_network_devices]

Parameters differences:

--- Nrpe::Check[check_check_certificate_expiry_network_devices].orig
+++ Nrpe::Check[check_check_certificate_expiry_network_devices]

-    before    => Monitoring::Service[check_certificate_expiry_network_devices]
-    ensure    => present
-    sudo_user => root
-    command   => /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/network_devices/ca/network_devices.pem

File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer]

Parameters differences:

--- File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer].orig
+++ File[/lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Exec[systemd daemon-reload for cfssl-ocsprefresh-mlserve_front_proxy.timer (cfssl-ocsprefresh-mlserve_front_proxy.timer)]

Content differences:

--- /lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer.orig
+++ /lib/systemd/system/cfssl-ocsprefresh-mlserve_front_proxy.timer
@@ -1,13 +0,0 @@
-[Unit]
-Description=Periodic execution of cfssl-ocsprefresh-mlserve_front_proxy.service
-
-[Timer]
-Unit=cfssl-ocsprefresh-mlserve_front_proxy.service
-# Accuracy sets the maximum time interval around the execution time we want to allow
-AccuracySec=15sec
-OnUnitInactiveSec=1h
-OnActiveSec=1s
-RandomizedDelaySec=0
-
-[Install]
-WantedBy=multi-user.target

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-mlserve.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_mlserve" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/etc/ferm/conf.d/10_csr_and_ocsp_responder]

Parameters differences:

--- File[/etc/ferm/conf.d/10_csr_and_ocsp_responder].orig
+++ File[/etc/ferm/conf.d/10_csr_and_ocsp_responder]

-    mode    => 0400
-    require => File[/etc/ferm/conf.d]
-    tag     => ferm
-    ensure  => present
-    owner   => root
-    group   => root
-    notify  => Service[ferm]

Content differences:

--- /etc/ferm/conf.d/10_csr_and_ocsp_responder.orig
+++ /etc/ferm/conf.d/10_csr_and_ocsp_responder
@@ -1,6 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 
-&R_SERVICE(tcp, 80, ($DOMAIN_NETWORKS $MGMT_NETWORKS));
-
-

File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem]

Parameters differences:

--- File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem].orig
+++ File[/etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem]

-    mode      => 0400
-    show_diff => False
-    before    => Systemd::Timer::Job[cfssl-ocsprefresh-Wikimedia_Internal_Root_CA]
-    owner     => root
-    group     => root
-    notify    => Service[cfssl-ocspserve@Wikimedia_Internal_Root_CA]

Content differences:

--- /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem.orig
+++ /etc/cfssl/ssl/ocsp/OCSP_Wikimedia_Internal_Root_CA_pki1001_eqiad_wmnet-key.pem
@@ -1 +0,0 @@
-FAKE FAKE FAKE

Systemd::Timer::Job[wmf_auto_restart_apache2]

Parameters differences:

--- Systemd::Timer::Job[wmf_auto_restart_apache2].orig
+++ Systemd::Timer::Job[wmf_auto_restart_apache2]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => Auto restart job: apache2
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => root
-    ignore_errors             => False
-    success_exit_status       => []
-    private_tmp               => False
-    logging_enabled           => True
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => False
-    require                   => File[/usr/local/sbin/wmf-auto-restart]
-    ensure                    => present
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 22:8:00'}
-    logfile_perms             => all
-    command                   => /usr/local/sbin/wmf-auto-restart -s apache2

Httpd::Mod_conf[filter]

Parameters differences:

--- Httpd::Mod_conf[filter].orig
+++ Httpd::Mod_conf[filter]

-    loadfile => filter.load
-    mod      => filter
-    ensure   => present

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-aux_front_proxy-certificate-expiry]
-    ensure   => present
-    priority => 40

Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service]

Parameters differences:

--- Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service].orig
+++ Systemd::Unit[cfssl-ocsprefresh-dse_front_proxy.service]

-    override          => False
-    unit              => cfssl-ocsprefresh-dse_front_proxy.service
-    require           => ['Class[Systemd]']
-    ensure            => present
-    restart           => False
-    override_filename => puppet-override.conf

File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf]

Parameters differences:

--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf].orig
+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf]

-    mode   => 0444
-    ensure => absent
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf.orig
+++ /etc/rsyslog.d/25-nrpe2nodexp-check-certificate-expiry-discovery2026.conf
@@ -1,10 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-if $programname contains "nrpe2nodexp-check_certificate_expiry_discovery2026" then {
-    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
-        # Send logs to kafka
-        set $.log_outputs = "kafka ecs_170 local";
-    } else {
-        # Filter out non-relevant nrpe2nodexp messages
-        stop
-    }
-}

File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

Parameters differences:

--- File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry].orig
+++ File[/var/log/prometheus-node-textfile-prometheus-check-wikikube_front_proxy-certificate-expiry]

-    mode   => 0755
-    force  => True
-    ensure => directory
-    owner  => root
-    backup => False
-    group  => root

File[/etc/cfssl/signers/dse_front_proxy/ca]

Parameters differences:

--- File[/etc/cfssl/signers/dse_front_proxy/ca].orig
+++ File[/etc/cfssl/signers/dse_front_proxy/ca]

-    mode    => 0550
-    require => ['Package[golang-cfssl]']
-    ensure  => directory
-    owner   => root
-    group   => root

File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery]

Parameters differences:

--- File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery].orig
+++ File[/etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery]

-    mode         => 0440
-    require      => Package[nagios-nrpe-server]
-    validate_cmd => /usr/sbin/visudo -cqf %
-    ensure       => present
-    owner        => root
-    group        => root

Content differences:

--- /etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery.orig
+++ /etc/sudoers.d/nrpe-check_check_certificate_expiry_discovery
@@ -1,3 +0,0 @@
-# This file is managed by Puppet!
-
-nagios ALL = (root) NOPASSWD: /usr/bin/openssl x509 -checkend 4687200 -in /etc/cfssl/signers/discovery/ca/discovery.pem

Rsyslog::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

Parameters differences:

--- Rsyslog::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry].orig
+++ Rsyslog::Conf[prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]

-    mode     => 0444
-    require  => File[/var/log/prometheus-node-textfile-prometheus-check-network_devices-certificate-expiry]
-    ensure   => present
-    priority => 40

Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

Parameters differences:

--- Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse_front_proxy].orig
+++ Systemd::Timer::Job[nrpe2nodexp-check_certificate_expiry_dse_front_proxy]

-    syslog_force_stop         => True
-    send_mail_to              => root@pki1001.eqiad.wmnet
-    description               => execution of nrpe2nodexp for the check_check_certificate_expiry_dse_front_proxy command.
-    send_mail_only_on_error   => True
-    send_mail                 => False
-    user                      => nagios
-    syslog_identifier         => nrpe2nodexp-check_certificate_expiry_dse_front_proxy
-    ignore_errors             => True
-    success_exit_status       => []
-    group                     => prometheus-node-exporter
-    private_tmp               => False
-    splay                     => 60
-    logging_enabled           => False
-    logfile_basedir           => /var/log
-    syslog_match_startswith   => True
-    monitoring_contact_groups => admins
-    logfile_name              => syslog.log
-    fixed_random_delay        => True
-    ensure                    => absent
-    logfile_group             => root
-    environment               => {}
-    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
-    monitoring_enabled        => False
-    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
-    logfile_perms             => all
-    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "2560f4f577ba169af651cf96bd5dc1ba" --timeout 10 --check-command "check_check_certificate_expiry_dse_front_proxy"

File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf].orig
+++ File[/etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf]

-    mode   => 0444
-    ensure => present
-    owner  => root
-    group  => root
-    notify => Service[rsyslog]

Content differences:

--- /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf.orig
+++ /etc/rsyslog.d/40-prometheus-node-textfile-prometheus-check-mlserve-front-proxy-certificate-expiry.conf
@@ -1,10 +0,0 @@
-# rsyslog.conf(5) configuration file for services.
-# This file is managed by Puppet.
-if $programname startswith "prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry" then {
-    action(
-        type="omfile" file="/var/log/prometheus-node-textfile-prometheus-check-mlserve_front_proxy-certificate-expiry/syslog.log"
-        fileOwner="root" fileGroup="root"
-        fileCreateMode="0644"
-    )
-    & stop
-}

Systemd::Syslog[cfssl-ocsprefresh-mlserve_front_proxy]

Parameters differences:

--- Systemd::Syslog[cfssl-ocsprefresh-mlserve_front_proxy].orig
+++ Systemd::Syslog[cfssl-ocsprefresh-mlserve_front_proxy]

-    base_dir               => /var/log
-    owner                  => root
-    force_stop             => True
-    programname_comparison => startswith
-    ensure                 => present
-    readable_by            => all
-    group                  => root
-    log_filename           => syslog.log

Compilation results for pki1001.eqiad.wmnet: System changes detected

Catalog differences

Summary

Resources only in the new catalog

Resources only in the old catalog

Resources modified

Relevant files