Compilation results for relforge1008.eqiad.wmnet: System changes detected

You can retrieve this result from host.json.

Catalog differences

Summary

Total Resources:	2893
Resources added:	71
Resources removed:	11
Resources modified:	92
Change percentage:	6.01%

Resources only in the new catalog

Class[Profile::Docker::Ferm]
Logrotate::Conf[wmf_auto_restart_docker]
Motd::Message[cirrus::relforge]
Service[wmf_auto_restart_docker.timer]
Logrotate::Conf[wmf_auto_restart_containerd]
Service::Docker[relforge]
Ferm::Service[elastic_small_alpha_https_9443]
Systemd::Timer[wmf_auto_restart_docker]
File[/etc/rsyslog.d/40-wmf-auto-restart-docker.conf]
File[/etc/docker]
Systemd::Syslog[wmf_auto_restart_docker]
File[/var/log/wmf_auto_restart_containerd]
Systemd::Unit[wmf_auto_restart_docker.service]
Class[Docker::Configuration]
File[/etc/modules-load.d/overlay.conf]
Rsyslog::Conf[wmf_auto_restart_docker]
Exec[systemd daemon-reload for wmf_auto_restart_containerd.timer (wmf_auto_restart_containerd.timer)]
Systemd::Timer[wmf_auto_restart_containerd]
Class[Docker]
File[/lib/systemd/system/wmf_auto_restart_docker.timer]
Class[Role::Cirrus::Relforge]
Class[Profile::Opensearch::Cirrus::Relforge]
File[/etc/ferm/conf.d/10_elastic_small_alpha_https_9443]
Profile::Auto_restarts::Service[docker]
Systemd::Service[wmf_auto_restart_docker]
Firewall::Service[elastic-main-https-9243]
Systemd::Service[wmf_auto_restart_containerd]
File[/etc/relforge]
File_line[auto_restart_file_presence_docker]
Exec[systemd daemon-reload for wmf_auto_restart_docker.service (wmf_auto_restart_docker.service)]
File[/etc/logrotate.d/wmf_auto_restart_docker]
Exec[/sbin/modprobe overlay]
File[/var/log/wmf_auto_restart_docker]
Exec[systemd daemon-reload for wmf_auto_restart_containerd.service (wmf_auto_restart_containerd.service)]
Service[wmf_auto_restart_containerd.timer]
Systemd::Timer::Job[wmf_auto_restart_containerd]
Systemd::Unit[wmf_auto_restart_containerd.service]
Systemd::Unit[wmf_auto_restart_containerd.timer]
File[/etc/rsyslog.d/40-wmf-auto-restart-containerd.conf]
Systemd::Syslog[wmf_auto_restart_containerd]
Motd::Script[cirrus::relforge]
Systemd::Unit[relforge]
File[/lib/systemd/system/wmf_auto_restart_containerd.service]
File[/etc/logrotate.d/wmf_auto_restart_containerd]
File[/etc/ferm/conf.d/10_elastic_main_https_9243]
Systemd::Timer::Job[wmf_auto_restart_docker]
Ferm::Service[elastic_main_https_9243]
Service[relforge]
File[/etc/ferm/conf.d/20_docker-ferm]
Exec[docker pull of docker-registry.wikimedia.org/repos/data-engineering/opensearch:2026-05-13-143357-2b2e022d3e2756b0dbd31d66e341a587f5d3b8d7-production2 for relforge]
File[/lib/systemd/system/wmf_auto_restart_containerd.timer]
Service[docker]
File[/lib/systemd/system/wmf_auto_restart_docker.service]
Package[apparmor]
Class[Profile::Docker::Engine]
Profile::Auto_restarts::Service[containerd]
Ferm::Conf[docker-ferm]
File[/lib/systemd/system/relforge.service]
Systemd::Service[relforge]
File[/etc/relforge/config.yaml]
File_line[auto_restart_file_presence_containerd]
Exec[systemd daemon-reload for wmf_auto_restart_docker.timer (wmf_auto_restart_docker.timer)]
Firewall::Service[elastic-small-alpha-https-9443]
Kmod::Module[overlay]
Package[docker.io]
File[/etc/update-motd.d/05-cirrus--relforge]
Rsyslog::Conf[wmf_auto_restart_containerd]
File[/etc/docker/daemon.json]
Systemd::Unit[wmf_auto_restart_docker.timer]
Exec[systemd daemon-reload for relforge.service (relforge)]
File[/etc/relforge/env]

Resources only in the old catalog

File[/etc/ferm/conf.d/10_opensearch_inter_node_9300]
Ferm::Service[opensearch_http_9200]
File[/etc/ferm/conf.d/10_opensearch_http_9200]
Motd::Message[cirrus::test]
Firewall::Service[opensearch-inter-node-9300]
Class[Role::Cirrus::Test]
Class[Profile::Opensearch::Cirrus::Test]
File[/etc/update-motd.d/05-cirrus--test]
Firewall::Service[opensearch-http-9200]
Motd::Script[cirrus::test]
Ferm::Service[opensearch_inter_node_9300]

Resources modified

Service::Docker[relforge]

Parameters differences:

--- Service::Docker[relforge].orig
+++ Service::Docker[relforge]

+    host_network => True
+    volume       => False
+    image_name   => opensearch
+    port         => 9200
+    config       => {}
+    namespace    => repos/data-engineering
+    environment  => {}
+    version      => 2026-05-13-143357-2b2e022d3e2756b0dbd31d66e341a587f5d3b8d7-production2
+    ensure       => present
+    override_cmd => 
+    bind_mounts  => {}

Firewall::Service[elastic-small-alpha-https-9443]

Parameters differences:

--- Firewall::Service[elastic-small-alpha-https-9443].orig
+++ Firewall::Service[elastic-small-alpha-https-9443]

+    notrack             => False
+    port                => 9443
+    desc                => 
+    srange              => (10.64.16.154 2620:0:861:102:10:64:16:154 10.192.32.49 2620:0:860:103:10:192:32:49)
+    prio                => 10
+    ensure              => present
+    proto               => tcp
+    unrestricted_access => False

File[/etc/docker/daemon.json]

Parameters differences:

--- File[/etc/docker/daemon.json].orig
+++ File[/etc/docker/daemon.json]

+    owner  => root
+    ensure => present
+    group  => root
+    mode   => 0440

Content differences:

--- /etc/docker/daemon.json.orig
+++ /etc/docker/daemon.json
@@ -0,0 +1,3 @@
+{
+  "storage-driver": "overlay2"
+}

Class[Docker::Configuration]

Parameters differences:

--- Class[Docker::Configuration].orig
+++ Class[Docker::Configuration]

+    settings  => {'storage-driver': 'overlay2'}
+    location  => /etc/docker/daemon.json
+    directory => /etc/docker

Systemd::Unit[wmf_auto_restart_docker.timer]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_docker.timer].orig
+++ Systemd::Unit[wmf_auto_restart_docker.timer]

+    override_filename => puppet-override.conf
+    require           => ['Class[Systemd]']
+    unit              => wmf_auto_restart_docker.timer
+    ensure            => present
+    restart           => False
+    override          => False

Motd::Message[cirrus::relforge]

Parameters differences:

--- Motd::Message[cirrus::relforge].orig
+++ Motd::Message[cirrus::relforge]

+    priority => 5
+    message  => relforge1008 is a OpenSearch relforge (cirrus::relforge)
+    ensure   => present

File[/etc/ferm/conf.d/10_opensearch_inter_node_9300]

Parameters differences:

--- File[/etc/ferm/conf.d/10_opensearch_inter_node_9300].orig
+++ File[/etc/ferm/conf.d/10_opensearch_inter_node_9300]

-    owner   => root
-    require => File[/etc/ferm/conf.d]
-    ensure  => present
-    notify  => Service[ferm]
-    tag     => ferm
-    group   => root
-    mode    => 0400

Content differences:

--- /etc/ferm/conf.d/10_opensearch_inter_node_9300.orig
+++ /etc/ferm/conf.d/10_opensearch_inter_node_9300
@@ -1,6 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 
-&R_SERVICE(tcp, 9300, (10.64.164.14 10.64.32.100 10.64.48.120 2620:0:861:103:10:64:32:100 2620:0:861:107:10:64:48:120 2620:0:861:12c:10:64:164:14));
-
-

Ferm::Service[opensearch_http_9200]

Parameters differences:

--- Ferm::Service[opensearch_http_9200].orig
+++ Ferm::Service[opensearch_http_9200]

-    src_sets            => ['ANALYTICS_NETWORKS']
-    notrack             => False
-    port                => [9200]
-    desc                => 
-    prio                => 10
-    ensure              => present
-    proto               => tcp
-    unrestricted_access => False

Class[Profile::Docker::Engine]

Parameters differences:

--- Class[Profile::Docker::Engine].orig
+++ Class[Profile::Docker::Engine]

+    settings        => {}
+    declare_service => True
+    packagename     => docker.io

Rsyslog::Conf[wmf_auto_restart_containerd]

Parameters differences:

--- Rsyslog::Conf[wmf_auto_restart_containerd].orig
+++ Rsyslog::Conf[wmf_auto_restart_containerd]

+    priority => 40
+    require  => File[/var/log/wmf_auto_restart_containerd]
+    ensure   => present
+    mode     => 0444

Systemd::Timer[wmf_auto_restart_docker]

Parameters differences:

--- Systemd::Timer[wmf_auto_restart_docker].orig
+++ Systemd::Timer[wmf_auto_restart_docker]

+    splay              => 0
+    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 6:45:00'}]
+    fixed_random_delay => False
+    ensure             => present
+    unit_name          => wmf_auto_restart_docker.service
+    accuracy           => 15sec

Ferm::Service[elastic_main_https_9243]

Parameters differences:

--- Ferm::Service[elastic_main_https_9243].orig
+++ Ferm::Service[elastic_main_https_9243]

+    notrack             => False
+    port                => 9243
+    desc                => 
+    srange              => (10.64.16.154 2620:0:861:102:10:64:16:154 10.192.32.49 2620:0:860:103:10:192:32:49)
+    prio                => 10
+    ensure              => present
+    proto               => tcp
+    unrestricted_access => False

Systemd::Syslog[wmf_auto_restart_docker]

Parameters differences:

--- Systemd::Syslog[wmf_auto_restart_docker].orig
+++ Systemd::Syslog[wmf_auto_restart_docker]

+    owner                  => root
+    base_dir               => /var/log
+    group                  => root
+    log_filename           => syslog.log
+    readable_by            => all
+    programname_comparison => startswith
+    ensure                 => present
+    force_stop             => True

File[/etc/relforge]

Parameters differences:

--- File[/etc/relforge].orig
+++ File[/etc/relforge]

+    owner  => root
+    mode   => 0755
+    ensure => directory
+    group  => root
+    force  => True

Firewall::Service[opensearch-http-9200]

Parameters differences:

--- Firewall::Service[opensearch-http-9200].orig
+++ Firewall::Service[opensearch-http-9200]

-    src_sets            => ['ANALYTICS_NETWORKS']
-    notrack             => False
-    port                => [9200]
-    desc                => 
-    prio                => 10
-    ensure              => present
-    proto               => tcp
-    unrestricted_access => False

File[/etc/logrotate.d/wmf_auto_restart_containerd]

Parameters differences:

--- File[/etc/logrotate.d/wmf_auto_restart_containerd].orig
+++ File[/etc/logrotate.d/wmf_auto_restart_containerd]

+    owner  => root
+    ensure => present
+    group  => root
+    mode   => 0444

Content differences:

--- /etc/logrotate.d/wmf_auto_restart_containerd.orig
+++ /etc/logrotate.d/wmf_auto_restart_containerd
@@ -0,0 +1,12 @@
+# logrotate(8) config for wmf_auto_restart_containerd
+
+/var/log/wmf_auto_restart_containerd/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

Exec[systemd daemon-reload for wmf_auto_restart_docker.timer (wmf_auto_restart_docker.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_docker.timer (wmf_auto_restart_docker.timer)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_docker.timer (wmf_auto_restart_docker.timer)]

+    before      => ['Service[wmf_auto_restart_docker.timer]']
+    command     => /bin/systemctl daemon-reload
+    refreshonly => True

Class[Profile::Base]

Parameters differences:

--- Class[Profile::Base].orig
+++ Class[Profile::Base]

@@
-    overlayfs => False
+    overlayfs => True

Class[Profile::Apt]

Parameters differences:

--- Class[Profile::Apt].orig
+++ Class[Profile::Apt]

@@
-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']
+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[docker.io]', 'Package[apparmor]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']

Motd::Script[cirrus::relforge]

Parameters differences:

--- Motd::Script[cirrus::relforge].orig
+++ Motd::Script[cirrus::relforge]

+    priority => 5
+    ensure   => present

File[/etc/update-motd.d/05-cirrus--relforge]

Parameters differences:

--- File[/etc/update-motd.d/05-cirrus--relforge].orig
+++ File[/etc/update-motd.d/05-cirrus--relforge]

+    owner  => root
+    ensure => present
+    group  => root
+    mode   => 0555

Content differences:

--- /etc/update-motd.d/05-cirrus--relforge.orig
+++ /etc/update-motd.d/05-cirrus--relforge
@@ -0,0 +1,2 @@
+#!/bin/sh
+printf "%s\n" "relforge1008 is a OpenSearch relforge (cirrus::relforge)"

Exec[systemd daemon-reload for wmf_auto_restart_containerd.timer (wmf_auto_restart_containerd.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_containerd.timer (wmf_auto_restart_containerd.timer)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_containerd.timer (wmf_auto_restart_containerd.timer)]

+    before      => ['Service[wmf_auto_restart_containerd.timer]']
+    command     => /bin/systemctl daemon-reload
+    refreshonly => True

Class[Profile::Opensearch::Cirrus::Relforge]

Parameters differences:

--- Class[Profile::Opensearch::Cirrus::Relforge].orig
+++ Class[Profile::Opensearch::Cirrus::Relforge]

+    image_vers    => 2026-05-13-143357-2b2e022d3e2756b0dbd31d66e341a587f5d3b8d7-production2
+    require       => ['Class[Profile::Docker::Engine]', 'Class[Profile::Docker::Ferm]']
+    image_name    => opensearch
+    image_ns      => repos/data-engineering
+    cumin_masters => ['10.64.16.154', '2620:0:861:102:10:64:16:154', '10.192.32.49', '2620:0:860:103:10:192:32:49']

Systemd::Unit[relforge]

Parameters differences:

--- Systemd::Unit[relforge].orig
+++ Systemd::Unit[relforge]

+    override_filename => puppet-override.conf
+    require           => ['Class[Systemd]']
+    unit              => relforge
+    ensure            => present
+    restart           => True
+    override          => False

File[/etc/relforge/config.yaml]

Parameters differences:

--- File[/etc/relforge/config.yaml].orig
+++ File[/etc/relforge/config.yaml]

+    owner  => root
+    ensure => present
+    notify => Service[relforge]
+    group  => root
+    mode   => 0444

Content differences:

--- /etc/relforge/config.yaml.orig
+++ /etc/relforge/config.yaml
@@ -0,0 +1 @@
+--- {}

File[/var/log/wmf_auto_restart_containerd]

Parameters differences:

--- File[/var/log/wmf_auto_restart_containerd].orig
+++ File[/var/log/wmf_auto_restart_containerd]

+    owner  => root
+    mode   => 0755
+    ensure => directory
+    backup => False
+    group  => root
+    force  => True

Class[Profile::Monitoring]

Parameters differences:

--- Class[Profile::Monitoring].orig
+++ Class[Profile::Monitoring]

@@
-    nrpe_check_disk_options => -w 6% -c 3% -W 6% -K 3% -l -e -A -i "/srv/sd[a-b][1-3]" -i "/srv/nvme[0-9]n[0-9]p[0-9]" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs
+    nrpe_check_disk_options => -w 15% -c 10% -W 6% -K 3% -l -e -A -i "/srv/sd[a-b][1-3]" --exclude-type=tracefs

Service[wmf_auto_restart_docker.timer]

Parameters differences:

--- Service[wmf_auto_restart_docker.timer].orig
+++ Service[wmf_auto_restart_docker.timer]

+    provider => systemd
+    enable   => True
+    ensure   => running

Systemd::Unit[wmf_auto_restart_docker.service]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_docker.service].orig
+++ Systemd::Unit[wmf_auto_restart_docker.service]

+    override_filename => puppet-override.conf
+    require           => ['Class[Systemd]']
+    unit              => wmf_auto_restart_docker.service
+    ensure            => present
+    restart           => False
+    override          => False

Kmod::Blacklist[wmf_overlay]

Parameters differences:

--- Kmod::Blacklist[wmf_overlay].orig
+++ Kmod::Blacklist[wmf_overlay]

@@
-    modules => ['overlayfs', 'overlay']
+    modules => []
@@
-    ensure  => present
+    ensure  => absent

Systemd::Unit[wmf_auto_restart_containerd.timer]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_containerd.timer].orig
+++ Systemd::Unit[wmf_auto_restart_containerd.timer]

+    override_filename => puppet-override.conf
+    require           => ['Class[Systemd]']
+    unit              => wmf_auto_restart_containerd.timer
+    ensure            => present
+    restart           => False
+    override          => False

File[/lib/systemd/system/wmf_auto_restart_docker.service]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_docker.service].orig
+++ File[/lib/systemd/system/wmf_auto_restart_docker.service]

+    owner  => root
+    ensure => present
+    notify => Exec[systemd daemon-reload for wmf_auto_restart_docker.service (wmf_auto_restart_docker.service)]
+    group  => root
+    mode   => 0444

Content differences:

--- /lib/systemd/system/wmf_auto_restart_docker.service.orig
+++ /lib/systemd/system/wmf_auto_restart_docker.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=Auto restart job: docker
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/sbin/wmf-auto-restart -s docker

File[/etc/ferm/conf.d/10_opensearch_http_9200]

Parameters differences:

--- File[/etc/ferm/conf.d/10_opensearch_http_9200].orig
+++ File[/etc/ferm/conf.d/10_opensearch_http_9200]

-    owner   => root
-    require => File[/etc/ferm/conf.d]
-    ensure  => present
-    notify  => Service[ferm]
-    tag     => ferm
-    group   => root
-    mode    => 0400

Content differences:

--- /etc/ferm/conf.d/10_opensearch_http_9200.orig
+++ /etc/ferm/conf.d/10_opensearch_http_9200
@@ -1,6 +0,0 @@
-# Autogenerated by puppet. DO NOT EDIT BY HAND!
-#
-# 
-&R_SERVICE(tcp, 9200, $ANALYTICS_NETWORKS);
-
-

Service[docker]

Parameters differences:

--- Service[docker].orig
+++ Service[docker]

+    ensure => running

Systemd::Service[wmf_auto_restart_docker]

Parameters differences:

--- Systemd::Service[wmf_auto_restart_docker].orig
+++ Systemd::Service[wmf_auto_restart_docker]

+    monitoring_enabled       => False
+    service_params           => {}
+    unit_type                => timer
+    restart                  => False
+    override                 => False
+    monitoring_contact_group => admins
+    require                  => Systemd::Unit[wmf_auto_restart_docker.service]
+    ensure                   => present
+    migration_task           => T407130
+    monitoring_critical      => False

File[/etc/docker]

Parameters differences:

--- File[/etc/docker].orig
+++ File[/etc/docker]

+    owner  => root
+    ensure => directory
+    group  => root
+    mode   => 0700

File[/etc/ferm/conf.d/20_docker-ferm]

Parameters differences:

--- File[/etc/ferm/conf.d/20_docker-ferm].orig
+++ File[/etc/ferm/conf.d/20_docker-ferm]

+    owner   => root
+    source  => puppet:///modules/profile/docker/docker-ferm
+    tag     => ferm
+    group   => root
+    require => File[/etc/ferm/conf.d]
+    ensure  => present
+    notify  => Service[ferm]
+    mode    => 0400

File[/etc/update-motd.d/05-cirrus--test]

Parameters differences:

--- File[/etc/update-motd.d/05-cirrus--test].orig
+++ File[/etc/update-motd.d/05-cirrus--test]

-    owner  => root
-    ensure => present
-    group  => root
-    mode   => 0555

Content differences:

--- /etc/update-motd.d/05-cirrus--test.orig
+++ /etc/update-motd.d/05-cirrus--test
@@ -1,2 +0,0 @@
-#!/bin/sh
-printf "%s\n" "relforge1008 is a Unpuppetised system for testing (cirrus::test)"

Service[relforge]

Parameters differences:

--- Service[relforge].orig
+++ Service[relforge]

+    enable => True
+    ensure => running

File[/var/log/wmf_auto_restart_docker]

Parameters differences:

--- File[/var/log/wmf_auto_restart_docker].orig
+++ File[/var/log/wmf_auto_restart_docker]

+    owner  => root
+    mode   => 0755
+    ensure => directory
+    backup => False
+    group  => root
+    force  => True

File[/var/lib/prometheus/node.d/role_owner.prom]

Content differences:

--- /var/lib/prometheus/node.d/role_owner.prom.orig
+++ /var/lib/prometheus/node.d/role_owner.prom
@@ -1,3 +1,3 @@
 # HELP role_owner The team owner of the server role
 # TYPE role_owner gauge
-role_owner{team="search-platform",role="cirrus::test",cluster="relforge"} 1.0
+role_owner{team="search-platform",role="cirrus::relforge",cluster="relforge"} 1.0

Rsyslog::Conf[wmf_auto_restart_docker]

Parameters differences:

--- Rsyslog::Conf[wmf_auto_restart_docker].orig
+++ Rsyslog::Conf[wmf_auto_restart_docker]

+    priority => 40
+    require  => File[/var/log/wmf_auto_restart_docker]
+    ensure   => present
+    mode     => 0444

Class[Docker]

Parameters differences:

--- Class[Docker].orig
+++ Class[Docker]

+    package_name => docker.io
+    require      => ['Class[Docker::Configuration]']

Exec[systemd daemon-reload for wmf_auto_restart_containerd.service (wmf_auto_restart_containerd.service)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_containerd.service (wmf_auto_restart_containerd.service)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_containerd.service (wmf_auto_restart_containerd.service)]

+    command     => /bin/systemctl daemon-reload
+    refreshonly => True

File[/lib/systemd/system/wmf_auto_restart_containerd.timer]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_containerd.timer].orig
+++ File[/lib/systemd/system/wmf_auto_restart_containerd.timer]

+    owner  => root
+    ensure => present
+    notify => Exec[systemd daemon-reload for wmf_auto_restart_containerd.timer (wmf_auto_restart_containerd.timer)]
+    group  => root
+    mode   => 0444

Content differences:

--- /lib/systemd/system/wmf_auto_restart_containerd.timer.orig
+++ /lib/systemd/system/wmf_auto_restart_containerd.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of wmf_auto_restart_containerd.service
+
+[Timer]
+Unit=wmf_auto_restart_containerd.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 5:4:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

File[/lib/systemd/system/wmf_auto_restart_docker.timer]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_docker.timer].orig
+++ File[/lib/systemd/system/wmf_auto_restart_docker.timer]

+    owner  => root
+    ensure => present
+    notify => Exec[systemd daemon-reload for wmf_auto_restart_docker.timer (wmf_auto_restart_docker.timer)]
+    group  => root
+    mode   => 0444

Content differences:

--- /lib/systemd/system/wmf_auto_restart_docker.timer.orig
+++ /lib/systemd/system/wmf_auto_restart_docker.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of wmf_auto_restart_docker.service
+
+[Timer]
+Unit=wmf_auto_restart_docker.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 6:45:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

Concat_fragment[main contacts]

Content differences:

--- main contacts.orig
+++ main contacts
@@ -1,3 +1,3 @@
 ---
-role::cirrus::test:
+role::cirrus::relforge:
 - Search Platform

Nrpe::Check[check_disk_space]

Parameters differences:

--- Nrpe::Check[check_disk_space].orig
+++ Nrpe::Check[check_disk_space]

@@
-    command => /usr/lib/nagios/plugins/check_disk -w 6% -c 3% -W 6% -K 3% -l -e -A -i "/srv/sd[a-b][1-3]" -i "/srv/nvme[0-9]n[0-9]p[0-9]" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs
+    command => /usr/lib/nagios/plugins/check_disk -w 15% -c 10% -W 6% -K 3% -l -e -A -i "/srv/sd[a-b][1-3]" --exclude-type=tracefs

File[/etc/nagios/nrpe.d/check_disk_space.cfg]

Content differences:

--- /etc/nagios/nrpe.d/check_disk_space.cfg.orig
+++ /etc/nagios/nrpe.d/check_disk_space.cfg
@@ -1,2 +1,2 @@
 # File generated by puppet. DO NOT edit by hand
-command[check_disk_space]=/usr/lib/nagios/plugins/check_disk -w 6% -c 3% -W 6% -K 3% -l -e -A -i "/srv/sd[a-b][1-3]" -i "/srv/nvme[0-9]n[0-9]p[0-9]" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs
+command[check_disk_space]=/usr/lib/nagios/plugins/check_disk -w 15% -c 10% -W 6% -K 3% -l -e -A -i "/srv/sd[a-b][1-3]" --exclude-type=tracefs

Concat::Fragment[main contacts]

File_line[auto_restart_file_presence_docker]

Parameters differences:

--- File_line[auto_restart_file_presence_docker].orig
+++ File_line[auto_restart_file_presence_docker]

+    line    => docker
+    path    => /etc/debdeploy-client/autorestarts.conf
+    require => File[/etc/debdeploy-client/autorestarts.conf]
+    ensure  => present

Systemd::Service[wmf_auto_restart_containerd]

Parameters differences:

--- Systemd::Service[wmf_auto_restart_containerd].orig
+++ Systemd::Service[wmf_auto_restart_containerd]

+    monitoring_enabled       => False
+    service_params           => {}
+    unit_type                => timer
+    restart                  => False
+    override                 => False
+    monitoring_contact_group => admins
+    require                  => Systemd::Unit[wmf_auto_restart_containerd.service]
+    ensure                   => present
+    migration_task           => T407130
+    monitoring_critical      => False

File[/etc/ferm/conf.d/10_elastic_main_https_9243]

Parameters differences:

--- File[/etc/ferm/conf.d/10_elastic_main_https_9243].orig
+++ File[/etc/ferm/conf.d/10_elastic_main_https_9243]

+    owner   => root
+    require => File[/etc/ferm/conf.d]
+    ensure  => present
+    notify  => Service[ferm]
+    tag     => ferm
+    group   => root
+    mode    => 0400

Content differences:

--- /etc/ferm/conf.d/10_elastic_main_https_9243.orig
+++ /etc/ferm/conf.d/10_elastic_main_https_9243
@@ -0,0 +1,6 @@
+# Autogenerated by puppet. DO NOT EDIT BY HAND!
+#
+# 
+&R_SERVICE(tcp, 9243, (10.64.16.154 2620:0:861:102:10:64:16:154 10.192.32.49 2620:0:860:103:10:192:32:49));
+
+

Systemd::Unit[wmf_auto_restart_containerd.service]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_containerd.service].orig
+++ Systemd::Unit[wmf_auto_restart_containerd.service]

+    override_filename => puppet-override.conf
+    require           => ['Class[Systemd]']
+    unit              => wmf_auto_restart_containerd.service
+    ensure            => present
+    restart           => False
+    override          => False

File[/etc/modprobe.d/blacklist-wmf_overlay.conf]

Parameters differences:

--- File[/etc/modprobe.d/blacklist-wmf_overlay.conf].orig
+++ File[/etc/modprobe.d/blacklist-wmf_overlay.conf]

@@
-    ensure => present
+    ensure => absent

Content differences:

--- /etc/modprobe.d/blacklist-wmf_overlay.conf.orig
+++ /etc/modprobe.d/blacklist-wmf_overlay.conf
@@ -1,7 +1,3 @@
 # wmf_overlay - blacklisted kernel modules
 # This file is managed by Puppet
 #
-blacklist overlay
-install overlay /bin/true
-blacklist overlayfs
-install overlayfs /bin/true

Logrotate::Conf[wmf_auto_restart_containerd]

Parameters differences:

--- Logrotate::Conf[wmf_auto_restart_containerd].orig
+++ Logrotate::Conf[wmf_auto_restart_containerd]

+    ensure => present

File[/lib/systemd/system/wmf_auto_restart_containerd.service]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_containerd.service].orig
+++ File[/lib/systemd/system/wmf_auto_restart_containerd.service]

+    owner  => root
+    ensure => present
+    notify => Exec[systemd daemon-reload for wmf_auto_restart_containerd.service (wmf_auto_restart_containerd.service)]
+    group  => root
+    mode   => 0444

Content differences:

--- /lib/systemd/system/wmf_auto_restart_containerd.service.orig
+++ /lib/systemd/system/wmf_auto_restart_containerd.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=Auto restart job: containerd
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/sbin/wmf-auto-restart -s containerd

Ferm::Conf[docker-ferm]

Parameters differences:

--- Ferm::Conf[docker-ferm].orig
+++ Ferm::Conf[docker-ferm]

+    source => puppet:///modules/profile/docker/docker-ferm
+    ensure => present
+    prio   => 20

Ferm::Service[elastic_small_alpha_https_9443]

Parameters differences:

--- Ferm::Service[elastic_small_alpha_https_9443].orig
+++ Ferm::Service[elastic_small_alpha_https_9443]

+    notrack             => False
+    port                => 9443
+    desc                => 
+    srange              => (10.64.16.154 2620:0:861:102:10:64:16:154 10.192.32.49 2620:0:860:103:10:192:32:49)
+    prio                => 10
+    ensure              => present
+    proto               => tcp
+    unrestricted_access => False

Exec[systemd daemon-reload for wmf_auto_restart_docker.service (wmf_auto_restart_docker.service)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_docker.service (wmf_auto_restart_docker.service)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_docker.service (wmf_auto_restart_docker.service)]

+    command     => /bin/systemctl daemon-reload
+    refreshonly => True

File[/etc/rsyslog.d/40-wmf-auto-restart-docker.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-wmf-auto-restart-docker.conf].orig
+++ File[/etc/rsyslog.d/40-wmf-auto-restart-docker.conf]

+    owner  => root
+    ensure => present
+    notify => Service[rsyslog]
+    group  => root
+    mode   => 0444

Content differences:

--- /etc/rsyslog.d/40-wmf-auto-restart-docker.conf.orig
+++ /etc/rsyslog.d/40-wmf-auto-restart-docker.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "wmf_auto_restart_docker" then {
+    action(
+        type="omfile" file="/var/log/wmf_auto_restart_docker/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

Motd::Script[cirrus::test]

Parameters differences:

--- Motd::Script[cirrus::test].orig
+++ Motd::Script[cirrus::test]

-    priority => 5
-    ensure   => present

File[/etc/rsyslog.d/40-wmf-auto-restart-containerd.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-wmf-auto-restart-containerd.conf].orig
+++ File[/etc/rsyslog.d/40-wmf-auto-restart-containerd.conf]

+    owner  => root
+    ensure => present
+    notify => Service[rsyslog]
+    group  => root
+    mode   => 0444

Content differences:

--- /etc/rsyslog.d/40-wmf-auto-restart-containerd.conf.orig
+++ /etc/rsyslog.d/40-wmf-auto-restart-containerd.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "wmf_auto_restart_containerd" then {
+    action(
+        type="omfile" file="/var/log/wmf_auto_restart_containerd/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

Motd::Message[cirrus::test]

Parameters differences:

--- Motd::Message[cirrus::test].orig
+++ Motd::Message[cirrus::test]

-    priority => 5
-    message  => relforge1008 is a Unpuppetised system for testing (cirrus::test)
-    ensure   => present

Firewall::Service[opensearch-inter-node-9300]

Parameters differences:

--- Firewall::Service[opensearch-inter-node-9300].orig
+++ Firewall::Service[opensearch-inter-node-9300]

-    notrack             => False
-    port                => [9300]
-    desc                => 
-    srange              => ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet']
-    prio                => 10
-    ensure              => present
-    proto               => tcp
-    unrestricted_access => False

Exec[systemd daemon-reload for relforge.service (relforge)]

Parameters differences:

--- Exec[systemd daemon-reload for relforge.service (relforge)].orig
+++ Exec[systemd daemon-reload for relforge.service (relforge)]

+    command     => /bin/systemctl daemon-reload
+    refreshonly => True
+    notify      => ['Service[relforge]']

Kmod::Module[overlay]

Parameters differences:

--- Kmod::Module[overlay].orig
+++ Kmod::Module[overlay]

+    ensure => present

Package[apparmor]

Parameters differences:

--- Package[apparmor].orig
+++ Package[apparmor]

+    provider => apt
+    ensure   => installed

Profile::Auto_restarts::Service[containerd]

Parameters differences:

--- Profile::Auto_restarts::Service[containerd].orig
+++ Profile::Auto_restarts::Service[containerd]

+    ensure => present

Class[Base::Kernel]

Parameters differences:

--- Class[Base::Kernel].orig
+++ Class[Base::Kernel]

@@
-    overlayfs => False
+    overlayfs => True

File[/etc/modules-load.d/overlay.conf]

Parameters differences:

--- File[/etc/modules-load.d/overlay.conf].orig
+++ File[/etc/modules-load.d/overlay.conf]

+    owner  => root
+    ensure => present
+    notify => Exec[/sbin/modprobe overlay]
+    group  => root
+    mode   => 0444

Content differences:

--- /etc/modules-load.d/overlay.conf.orig
+++ /etc/modules-load.d/overlay.conf
@@ -0,0 +1 @@
+overlay

Systemd::Syslog[wmf_auto_restart_containerd]

Parameters differences:

--- Systemd::Syslog[wmf_auto_restart_containerd].orig
+++ Systemd::Syslog[wmf_auto_restart_containerd]

+    owner                  => root
+    base_dir               => /var/log
+    group                  => root
+    log_filename           => syslog.log
+    readable_by            => all
+    programname_comparison => startswith
+    ensure                 => present
+    force_stop             => True

Package[docker.io]

Parameters differences:

--- Package[docker.io].orig
+++ Package[docker.io]

+    provider => apt
+    ensure   => installed

File[/etc/ferm/conf.d/10_elastic_small_alpha_https_9443]

Parameters differences:

--- File[/etc/ferm/conf.d/10_elastic_small_alpha_https_9443].orig
+++ File[/etc/ferm/conf.d/10_elastic_small_alpha_https_9443]

+    owner   => root
+    require => File[/etc/ferm/conf.d]
+    ensure  => present
+    notify  => Service[ferm]
+    tag     => ferm
+    group   => root
+    mode    => 0400

Content differences:

--- /etc/ferm/conf.d/10_elastic_small_alpha_https_9443.orig
+++ /etc/ferm/conf.d/10_elastic_small_alpha_https_9443
@@ -0,0 +1,6 @@
+# Autogenerated by puppet. DO NOT EDIT BY HAND!
+#
+# 
+&R_SERVICE(tcp, 9443, (10.64.16.154 2620:0:861:102:10:64:16:154 10.192.32.49 2620:0:860:103:10:192:32:49));
+
+

Systemd::Timer[wmf_auto_restart_containerd]

Parameters differences:

--- Systemd::Timer[wmf_auto_restart_containerd].orig
+++ Systemd::Timer[wmf_auto_restart_containerd]

+    splay              => 0
+    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 5:4:00'}]
+    fixed_random_delay => False
+    ensure             => present
+    unit_name          => wmf_auto_restart_containerd.service
+    accuracy           => 15sec

Systemd::Timer::Job[wmf_auto_restart_docker]

Parameters differences:

--- Systemd::Timer::Job[wmf_auto_restart_docker].orig
+++ Systemd::Timer::Job[wmf_auto_restart_docker]

+    monitoring_enabled        => False
+    user                      => root
+    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 6:45:00'}
+    logfile_basedir           => /var/log
+    private_tmp               => False
+    logfile_group             => root
+    logfile_perms             => all
+    ensure                    => present
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_match_startswith   => True
+    monitoring_contact_groups => admins
+    syslog_force_stop         => True
+    logging_enabled           => True
+    send_mail                 => False
+    environment               => {}
+    description               => Auto restart job: docker
+    logfile_name              => syslog.log
+    require                   => File[/usr/local/sbin/wmf-auto-restart]
+    fixed_random_delay        => False
+    success_exit_status       => []
+    command                   => /usr/local/sbin/wmf-auto-restart -s docker
+    send_mail_to              => root@relforge1008.eqiad.wmnet
+    send_mail_only_on_error   => True
+    ignore_errors             => False

Firewall::Service[elastic-main-https-9243]

Parameters differences:

--- Firewall::Service[elastic-main-https-9243].orig
+++ Firewall::Service[elastic-main-https-9243]

+    notrack             => False
+    port                => 9243
+    desc                => 
+    srange              => (10.64.16.154 2620:0:861:102:10:64:16:154 10.192.32.49 2620:0:860:103:10:192:32:49)
+    prio                => 10
+    ensure              => present
+    proto               => tcp
+    unrestricted_access => False

Ferm::Service[opensearch_inter_node_9300]

Parameters differences:

--- Ferm::Service[opensearch_inter_node_9300].orig
+++ Ferm::Service[opensearch_inter_node_9300]

-    notrack             => False
-    port                => [9300]
-    desc                => 
-    srange              => ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet']
-    prio                => 10
-    ensure              => present
-    proto               => tcp
-    unrestricted_access => False

Systemd::Timer::Job[wmf_auto_restart_containerd]

Parameters differences:

--- Systemd::Timer::Job[wmf_auto_restart_containerd].orig
+++ Systemd::Timer::Job[wmf_auto_restart_containerd]

+    monitoring_enabled        => False
+    user                      => root
+    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 5:4:00'}
+    logfile_basedir           => /var/log
+    private_tmp               => False
+    logfile_group             => root
+    logfile_perms             => all
+    ensure                    => present
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_match_startswith   => True
+    monitoring_contact_groups => admins
+    syslog_force_stop         => True
+    logging_enabled           => True
+    send_mail                 => False
+    environment               => {}
+    description               => Auto restart job: containerd
+    logfile_name              => syslog.log
+    require                   => File[/usr/local/sbin/wmf-auto-restart]
+    fixed_random_delay        => False
+    success_exit_status       => []
+    command                   => /usr/local/sbin/wmf-auto-restart -s containerd
+    send_mail_to              => root@relforge1008.eqiad.wmnet
+    send_mail_only_on_error   => True
+    ignore_errors             => False

Profile::Auto_restarts::Service[docker]

Parameters differences:

--- Profile::Auto_restarts::Service[docker].orig
+++ Profile::Auto_restarts::Service[docker]

+    ensure => present

Class[Adduser]

Parameters differences:

--- Class[Adduser].orig
+++ Class[Adduser]

@@
-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']
+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[docker.io]', 'Package[apparmor]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']

File[/etc/logrotate.d/wmf_auto_restart_docker]

Parameters differences:

--- File[/etc/logrotate.d/wmf_auto_restart_docker].orig
+++ File[/etc/logrotate.d/wmf_auto_restart_docker]

+    owner  => root
+    ensure => present
+    group  => root
+    mode   => 0444

Content differences:

--- /etc/logrotate.d/wmf_auto_restart_docker.orig
+++ /etc/logrotate.d/wmf_auto_restart_docker
@@ -0,0 +1,12 @@
+# logrotate(8) config for wmf_auto_restart_docker
+
+/var/log/wmf_auto_restart_docker/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

Service[wmf_auto_restart_containerd.timer]

Parameters differences:

--- Service[wmf_auto_restart_containerd.timer].orig
+++ Service[wmf_auto_restart_containerd.timer]

+    provider => systemd
+    enable   => True
+    ensure   => running

Exec[/sbin/modprobe overlay]

Parameters differences:

--- Exec[/sbin/modprobe overlay].orig
+++ Exec[/sbin/modprobe overlay]

+    unless      => /bin/lsmod | /bin/grep -q '^overlay '
+    refreshonly => True

File[/lib/systemd/system/relforge.service]

Parameters differences:

--- File[/lib/systemd/system/relforge.service].orig
+++ File[/lib/systemd/system/relforge.service]

+    owner  => root
+    ensure => present
+    notify => Exec[systemd daemon-reload for relforge.service (relforge)]
+    group  => root
+    mode   => 0444

Content differences:

--- /lib/systemd/system/relforge.service.orig
+++ /lib/systemd/system/relforge.service
@@ -0,0 +1,20 @@
+
+[Unit]
+Description=Systemd runner for relforge
+After=docker.service
+BindsTo=docker.service
+
+[Service]
+ExecStartPre=-/usr/bin/docker stop %n
+ExecStartPre=-/usr/bin/docker rm %n
+ExecStart=/usr/bin/docker run --rm=true  --env-file /etc/relforge/env --network host -v /etc/relforge/:/etc/relforge --name %n docker-registry.wikimedia.org/repos/data-engineering/opensearch:2026-05-13-143357-2b2e022d3e2756b0dbd31d66e341a587f5d3b8d7-production2 
+Restart=always
+RestartSec=10s
+NotifyAccess=all
+# Let docker do its things on its own terms
+TimeoutStartSec=120
+TimeoutStopSec=15
+SyslogIdentifier=docker-relforge
+
+[Install]
+WantedBy=multi-user.target

Systemd::Service[relforge]

Parameters differences:

--- Systemd::Service[relforge].orig
+++ Systemd::Service[relforge]

+    monitoring_enabled       => False
+    service_params           => {}
+    unit_type                => service
+    restart                  => True
+    override                 => False
+    monitoring_contact_group => admins
+    ensure                   => present
+    migration_task           => T407130
+    monitoring_critical      => False

File[/etc/relforge/env]

Parameters differences:

--- File[/etc/relforge/env].orig
+++ File[/etc/relforge/env]

+    owner     => root
+    show_diff => False
+    ensure    => present
+    notify    => Service[relforge]
+    group     => root
+    mode      => 0440

Class[Profile::Base::Production]

Parameters differences:

--- Class[Profile::Base::Production].orig
+++ Class[Profile::Base::Production]

@@
-    role_description => Unpuppetised system for testing
+    role_description => OpenSearch relforge

Exec[docker pull of docker-registry.wikimedia.org/repos/data-engineering/opensearch:2026-05-13-143357-2b2e022d3e2756b0dbd31d66e341a587f5d3b8d7-production2 for relforge]

Parameters differences:

--- Exec[docker pull of docker-registry.wikimedia.org/repos/data-engineering/opensearch:2026-05-13-143357-2b2e022d3e2756b0dbd31d66e341a587f5d3b8d7-production2 for relforge].orig
+++ Exec[docker pull of docker-registry.wikimedia.org/repos/data-engineering/opensearch:2026-05-13-143357-2b2e022d3e2756b0dbd31d66e341a587f5d3b8d7-production2 for relforge]

+    unless  => /usr/bin/docker pull 'docker-registry.wikimedia.org/repos/data-engineering/opensearch:2026-05-13-143357-2b2e022d3e2756b0dbd31d66e341a587f5d3b8d7-production2' | grep -q 'up to date'
+    command => /usr/bin/true
+    notify  => Service[relforge]

Nrpe::Monitor_service[disk_space]

Parameters differences:

--- Nrpe::Monitor_service[disk_space].orig
+++ Nrpe::Monitor_service[disk_space]

@@
-    nrpe_command => /usr/lib/nagios/plugins/check_disk -w 6% -c 3% -W 6% -K 3% -l -e -A -i "/srv/sd[a-b][1-3]" -i "/srv/nvme[0-9]n[0-9]p[0-9]" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs
+    nrpe_command => /usr/lib/nagios/plugins/check_disk -w 15% -c 10% -W 6% -K 3% -l -e -A -i "/srv/sd[a-b][1-3]" --exclude-type=tracefs

Logrotate::Conf[wmf_auto_restart_docker]

Parameters differences:

--- Logrotate::Conf[wmf_auto_restart_docker].orig
+++ Logrotate::Conf[wmf_auto_restart_docker]

+    ensure => present

File_line[auto_restart_file_presence_containerd]

Parameters differences:

--- File_line[auto_restart_file_presence_containerd].orig
+++ File_line[auto_restart_file_presence_containerd]

+    line    => containerd
+    path    => /etc/debdeploy-client/autorestarts.conf
+    require => File[/etc/debdeploy-client/autorestarts.conf]
+    ensure  => present

Compilation results for relforge1008.eqiad.wmnet: System changes detected

Catalog differences

Summary

Resources only in the new catalog

Resources only in the old catalog

Resources modified

Relevant files