Compilation results for pki-root1002.eqiad.wmnet: System changes detected
You can retrieve this result from host.json.Catalog differences
Summary
| Total Resources: | 2929 |
|---|---|
| Resources added: | 378 |
| Resources removed: | 165 |
| Resources modified: | 567 |
| Change percentage: | 37.90% |
Resources only in the new catalog
- Service[bacula-fd]
- File[/etc/cfssl/ssl/etcd/etcd-key.pem]
- File[/etc/cfssl/ssl/aux_front_proxy/aux_front_proxy.csr]
- Cfssl::Signer[Wikimedia_Internal_Root_CA]
- File[/etc/cfssl/ssl/discovery2026/discovery2026.csr]
- Cfssl::Csr[/etc/cfssl/csr/puppet.csr]
- Systemd::Timer[wmf_auto_restart_ulogd2]
- File[/etc/cfssl/ssl/mlserve_front_proxy/mlserve_front_proxy.csr]
- Concat_file[/etc/bacula/ssl/cert.pem]
- Exec[renew certificate - wikikube_staging_front_proxy]
- File[/etc/cfssl/csr/syslog.csr]
- Prometheus::Alert::Rule[check_ferm_active_bba0a2572329bb500b832470e08b381c]
- Exec[renew certificate - mlserve_staging]
- Exec[Generate cert aux refresh]
- Ferm::Rule[drop-blocked-nets]
- Package[ulogd2]
- File[/etc/cfssl/ssl/zuul/zuul.csr]
- Apt::Package_from_component[bacula-trixie]
- Exec[Generate cert aux_front_proxy]
- Exec[Generate cert wikikube_staging_front_proxy]
- File[/etc/cfssl/ssl/cloud_wmnet_ca/cloud_wmnet_ca.csr]
- Cfssl::Csr[/etc/cfssl/csr/aux.csr]
- File[/var/log/wmf_auto_restart_ulogd2]
- File[/etc/cfssl/ssl/wikikube_staging/wikikube_staging-key.pem]
- Exec[renew certificate - Wikimedia_Internal_Root_CA_ocsp_signing_cert]
- File[/etc/cfssl/ssl/debmonitor/debmonitor-key.pem]
- Exec[Generate cert wikikube refresh]
- Cfssl::Csr[/etc/cfssl/csr/network_devices.csr]
- Exec[update_alternative_iptables]
- Cfssl::Csr[/etc/cfssl/csr/mlserve_staging.csr]
- File[/etc/cfssl/ssl/wikikube_front_proxy/wikikube_front_proxy-key.pem]
- File[/etc/cfssl/signers/Wikimedia_Internal_Root_CA/db.conf]
- File[/etc/cfssl/ssl/cassandra/cassandra-key.pem]
- Exec[Generate cert mlserve]
- Ferm::Rule[log-everything]
- Systemd::Service[wmf_auto_restart_ulogd2]
- File[/etc/cfssl/csr/cassandra.csr]
- File[/etc/cfssl/ssl/syslog/syslog.csr]
- File[/etc/ferm/conf.d/98_log-everything]
- Cfssl::Csr[/etc/cfssl/csr/Wikimedia_Internal_Root_CA.csr]
- File[/etc/ferm/conf.d/10_ssh_from_cumin_masters]
- Exec[Generate cert cassandra]
- File[/etc/cfssl/ssl/mlserve_staging_front_proxy/mlserve_staging_front_proxy.pem]
- Cfssl::Config[Wikimedia_Internal_Root_CA]
- File[/etc/cfssl/ssl/discovery2026]
- Exec[renew certificate - cloud_wmnet_ca]
- File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA_ocsp_signing_cert/Wikimedia_Internal_Root_CA_ocsp_signing_cert.csr]
- Exec[Generate cert cloud_wmnet_ca]
- Exec[renew certificate - puppet]
- Exec[Generate cert zuul]
- Exec[renew certificate - wikikube]
- File[/etc/cfssl/csr/wikikube_staging.csr]
- File[/etc/cfssl/ssl/mlserve/mlserve.csr]
- Cfssl::Csr[/etc/cfssl/csr/discovery2026.csr]
- Exec[Generate cert etcd refresh]
- Logrotate::Conf[wmf_auto_restart_ulogd2]
- File[/etc/cfssl/ssl/dse]
- File[/etc/cfssl/ssl/puppet/puppet.pem]
- File[/etc/cfssl/ssl/cloud_wmnet_ca/cloud_wmnet_ca-key.pem]
- Exec[Generate cert Wikimedia_Internal_Root_CA_ocsp_signing_cert refresh]
- Cfssl::Cert[mlserve_front_proxy]
- Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.service (nrpe2nodexp-ferm_active.service)]
- Systemd::Unit[wmf_auto_restart_ulogd2.timer]
- File[/etc/cfssl/ssl/dse_front_proxy]
- File[/etc/cfssl/ssl/network_devices/network_devices-key.pem]
- Service[wmf_auto_restart_ulogd2.timer]
- File[/etc/cfssl/ssl/wikikube_staging_front_proxy/wikikube_staging_front_proxy-key.pem]
- Exec[Generate cert cassandra refresh]
- Exec[Generate cert wikikube]
- File[/etc/sudoers.d/nrpe-check_ferm_active]
- Cfssl::Cert[cloud_wmnet_ca]
- Ferm::Service[ssh_from_bastion]
- File[/etc/cfssl/ssl/mlserve]
- Concat_file[/etc/apt/sources.list.d/component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]
- File[/etc/bacula/bacula-fd.conf]
- File[/etc/bacula/ssl/server.key]
- File[/etc/cfssl/ssl/cloud_wmnet_ca/cloud_wmnet_ca.pem]
- File[/etc/bacula/ssl]
- Exec[Generate cert dse]
- Cfssl::Cert[puppet_rsa]
- File[/etc/cfssl/ssl/mlserve/mlserve-key.pem]
- Exec[Generate cert mlserve_staging_front_proxy]
- Exec[Generate cert mlserve refresh]
- Exec[Generate cert wikikube_front_proxy refresh]
- File[/etc/cfssl/ssl/aux_front_proxy/aux_front_proxy-key.pem]
- Exec[Generate cert dse_front_proxy]
- Cfssl::Csr[/etc/cfssl/csr/cloud_wmnet_ca.csr]
- Class[Profile::Pki::Root_ca]
- Alternatives::Select[ip6tables]
- Concat[/etc/apt/sources.list.d/component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]
- Cfssl::Csr[/etc/cfssl/csr/mlserve.csr]
- Systemd::Timer::Job[wmf_auto_restart_ulogd2]
- Motd::Script[pki::root]
- File[/etc/cfssl/csr/Wikimedia_Internal_Root_CA_ocsp_signing_cert.csr]
- File[/etc/cfssl/ssl/syslog/syslog-key.pem]
- File[/etc/cfssl/ssl/cassandra/cassandra.csr]
- File[/etc/cfssl/ssl/mlserve_staging_front_proxy]
- Exec[apt_repository_component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia]
- Cfssl::Csr[/etc/cfssl/csr/dse.csr]
- Profile::Auto_restarts::Service[ulogd2]
- File[/etc/cfssl/ssl/kafka/kafka.pem]
- File[/etc/ferm/conf.d/02_main]
- Exec[Generate cert cloud_wmnet_ca refresh]
- Exec[renew certificate - puppet_rsa]
- File[/etc/cfssl/csr/mlserve.csr]
- File[/etc/cfssl/ssl/syslog]
- Concat_fragment[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia]
- File[/etc/cfssl/ssl/wikikube_staging/wikikube_staging.pem]
- File[/etc/systemd/system/ferm.service.d/ferm-service-status-restart.conf]
- File[/etc/cfssl/ssl/cloud_wmnet_ca]
- File[/etc/cfssl/ssl/wikikube_front_proxy/wikikube_front_proxy.pem]
- Exec[Generate cert wikikube_staging_front_proxy refresh]
- Systemd::Timer::Job[nrpe2nodexp-ferm_active]
- File[/etc/cfssl/ssl/wikikube_staging]
- Cfssl::Cert[etcd]
- File[/etc/cfssl/csr/discovery2026.csr]
- Cfssl::Csr[/etc/cfssl/csr/debmonitor.csr]
- Exec[Generate cert debmonitor refresh]
- File[/etc/rsyslog.d/40-ulogd.conf]
- File[/etc/cfssl/ssl/mlserve_staging/mlserve_staging.pem]
- Cfssl::Cert[wikikube_front_proxy]
- Concat_fragment[/etc/bacula_puppet_ca_chain]
- Systemd::Service[nrpe2nodexp-ferm_active]
- Exec[renew certificate - kafka]
- File[/etc/cfssl/ssl/wikikube]
- File[/etc/cfssl/ssl/aux/aux-key.pem]
- File[/etc/cfssl/ssl/puppet_rsa/puppet_rsa.csr]
- File[/etc/cfssl/ssl/wikikube_staging_front_proxy/wikikube_staging_front_proxy.pem]
- Cfssl::Cert[dse]
- Package[bacula-common]
- Exec[Generate cert network_devices refresh]
- File[/etc/ferm/conf.d]
- File[/etc/cfssl/ssl/mlserve_front_proxy]
- File[/etc/cfssl/ssl/dse_front_proxy/dse_front_proxy.pem]
- File[/etc/cfssl/ssl/network_devices/network_devices.csr]
- File[/etc/cfssl/ssl/network_devices/network_devices.pem]
- Motd::Script[backups-pki-root-cfssl]
- Exec[Generate cert puppet_rsa]
- Ferm::Conf[defs]
- File[/etc/cfssl/csr/puppet.csr]
- File_line[auto_restart_file_presence_ulogd2]
- Class[Profile::Backup::Host]
- File[/etc/ferm/conf.d/98_filter_log_filter-bootp]
- Exec[Generate cert Wikimedia_Internal_Root_CA_ocsp_signing_cert]
- Cfssl::Cert[wikikube]
- Exec[Generate cert wikikube_staging refresh]
- Cfssl::Csr[/etc/cfssl/csr/cassandra.csr]
- Service[ulogd2]
- File[/etc/cfssl/ssl/debmonitor]
- File[/etc/cfssl/ssl/wikikube_staging/wikikube_staging.csr]
- Systemd::Unit[nrpe2nodexp-ferm_active.timer]
- File[/lib/systemd/system/wmf_auto_restart_ulogd2.timer]
- File[/etc/cfssl/csr/mlserve_staging_front_proxy.csr]
- Concat_fragment[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]
- File[/etc/ferm/conf.d/00_defs]
- File[/etc/cfssl/ssl/aux_front_proxy/aux_front_proxy.pem]
- File[/etc/cfssl/csr/puppet_rsa.csr]
- File[/etc/cfssl/ssl/mlserve_staging_front_proxy/mlserve_staging_front_proxy-key.pem]
- Concat[/etc/bacula/ssl/cert.pem]
- Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.timer (nrpe2nodexp-ferm_active.timer)]
- Exec[renew certificate - mlserve]
- File[/etc/cfssl/ssl/cassandra/cassandra.pem]
- File[/etc/cfssl/ssl/mlserve/mlserve.pem]
- File[/etc/apt/sources.list.d/component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia.list]
- File[/etc/cfssl/ssl/wikikube_staging_front_proxy]
- File[/etc/cfssl/ssl/etcd/etcd.csr]
- Exec[renew certificate - debmonitor]
- File[/etc/cfssl/csr/aux.csr]
- File[/etc/cfssl/ssl/puppet_rsa]
- Cfssl::Cert[wikikube_staging]
- Systemd::Timer[nrpe2nodexp-ferm_active]
- Exec[Generate cert wikikube_front_proxy]
- Backup::Set[pki-root-cfssl]
- Concat::Fragment[/etc/bacula_puppet_agent_cert]
- Node[__node_regexp__pki-root10012.eqiad.]
- File[/etc/logrotate.d/ulogd]
- Class[Role::Pki::Root]
- File[/etc/cfssl/ssl/syslog/syslog.pem]
- File[/etc/cfssl/ssl/mlserve_staging/mlserve_staging-key.pem]
- Exec[Generate cert puppet_rsa refresh]
- Cfssl::Csr[/etc/cfssl/csr/dse_front_proxy.csr]
- Exec[Generate cert mlserve_front_proxy refresh]
- Concat_fragment[/etc/bacula_puppet_agent_cert]
- Class[Bacula::Client]
- Exec[Generate cert aux]
- Rsyslog::Conf[wmf_auto_restart_ulogd2]
- File[/etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf]
- Exec[renew certificate - wikikube_staging]
- File[/etc/cfssl/ssl/kafka/kafka.csr]
- Exec[apt_package_from_component_bacula-trixie]
- Exec[Generate cert network_devices]
- Exec[Generate cert mlserve_front_proxy]
- File[/etc/nagios/nrpe.d/check_ferm_active.cfg]
- Rsyslog::Conf[nrpe2nodexp-ferm_active]
- Cfssl::Cert[dse_front_proxy]
- Cfssl::Cert[Wikimedia_Internal_Root_CA_ocsp_signing_cert]
- File[/etc/cfssl/ssl/wikikube_front_proxy/wikikube_front_proxy.csr]
- Exec[Generate cert puppet]
- File[/etc/cfssl/ssl/discovery2026/discovery2026-key.pem]
- File[/etc/cfssl/ssl/puppet_rsa/puppet_rsa.pem]
- Cfssl::Csr[/etc/cfssl/csr/wikikube_front_proxy.csr]
- Exec[Generate cert mlserve_staging]
- Ferm::Conf[main]
- File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA_ocsp_signing_cert/Wikimedia_Internal_Root_CA_ocsp_signing_cert-key.pem]
- File[/etc/cfssl/ssl/kafka/kafka-key.pem]
- Cfssl::Csr[/etc/cfssl/csr/wikikube_staging.csr]
- File[/etc/cfssl/ssl/dse/dse.csr]
- Exec[renew certificate - syslog]
- Exec[Generate cert discovery2026]
- Alternatives::Select[iptables]
- File[/etc/cfssl/csr/mlserve_front_proxy.csr]
- Systemd::Override[ferm-service-status-restart]
- Cfssl::Cert[puppet]
- File[/etc/cfssl/ssl/discovery2026/discovery2026.pem]
- File[/etc/cfssl/csr/wikikube_staging_front_proxy.csr]
- Cfssl::Csr[/etc/cfssl/csr/aux_front_proxy.csr]
- File[/var/log/ulogd]
- Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.timer (wmf_auto_restart_ulogd2.timer)]
- File[/etc/ferm/conf.d/10_ssh_from_bastion]
- Cfssl::Csr[/etc/cfssl/csr/mlserve_front_proxy.csr]
- Exec[renew certificate - etcd]
- File[/etc/cfssl/csr/wikikube_front_proxy.csr]
- Cfssl::Cert[discovery2026]
- File[/etc/cfssl/ssl/dse/dse.pem]
- Cfssl::Cert[aux_front_proxy]
- Exec[renew certificate - discovery2026]
- Systemd::Syslog[ulogd]
- Exec[renew certificate - aux]
- File[/etc/cfssl/ssl/puppet_rsa/puppet_rsa-key.pem]
- Monitoring::Service[ferm_active]
- Exec[update_alternative_ip6tables]
- File[/etc/cfssl/ssl/dse_front_proxy/dse_front_proxy.csr]
- Systemd::Unit[ferm-ferm-service-status-restart]
- File[/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca]
- Cfssl::Csr[/etc/cfssl/csr/Wikimedia_Internal_Root_CA_ocsp_signing_cert.csr]
- Ferm::Service[bacula_file_daemon_backup1014_eqiad_wmnet]
- File[/etc/cfssl/ssl/kafka]
- File[/etc/ferm/conf.d/99_dscp-default]
- File[/etc/cfssl/ssl/puppet]
- Systemd::Unit[nrpe2nodexp-ferm_active.service]
- File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA_ocsp_signing_cert]
- File[/etc/default/ferm]
- Cfssl::Db[Wikimedia_Internal_Root_CA]
- File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_udp]
- Package[bacula-fd]
- Ferm::Rule[filter_log_filter-bootp]
- Cfssl::Csr[/etc/cfssl/csr/etcd.csr]
- File[/etc/cfssl/ssl/dse_front_proxy/dse_front_proxy-key.pem]
- File[/etc/cfssl/ssl/zuul/zuul.pem]
- File[/etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf]
- Cfssl::Csr[/etc/cfssl/csr/wikikube.csr]
- Cfssl::Cert[cassandra]
- Cfssl::Csr[/etc/cfssl/csr/mlserve_staging_front_proxy.csr]
- Puppet::Expose_agent_certs[/etc/bacula]
- Exec[Generate cert syslog refresh]
- Exec[Generate cert zuul refresh]
- Exec[renew certificate - network_devices]
- Exec[Generate cert dse refresh]
- File[/etc/ferm/ferm.conf]
- File[/etc/logrotate.d/wmf_auto_restart_ulogd2]
- File[/etc/cfssl/ssl/wikikube_staging_front_proxy/wikikube_staging_front_proxy.csr]
- File[/etc/cfssl/ssl/etcd/etcd.pem]
- File[/etc/cfssl/csr/dse_front_proxy.csr]
- Concat::Fragment[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia]
- File[/etc/cfssl/ssl/aux]
- File[/etc/cfssl/ssl/wikikube/wikikube.csr]
- Nrpe::Monitor_service[ferm_active]
- Cfssl::Cert[debmonitor]
- Exec[renew certificate - dse_front_proxy]
- File[/etc/cfssl/signers/Wikimedia_Internal_Root_CA]
- Ferm::Service[full_monitoring_metrics_access_tcp]
- Exec[Generate cert etcd]
- File[/etc/cfssl/ssl/etcd]
- Exec[Generate cert dse_front_proxy refresh]
- Exec[renew certificate - cassandra]
- File[/etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf]
- Systemd::Syslog[wmf_auto_restart_ulogd2]
- File[/etc/cfssl/csr/etcd.csr]
- File[/etc/cfssl/ssl/debmonitor/debmonitor.csr]
- Exec[create-/etc/bacula-keypair]
- File[/etc/cfssl/ssl/debmonitor/debmonitor.pem]
- File[/etc/cfssl/ssl/puppet/puppet.csr]
- Exec[renew certificate - dse]
- File[/etc/cfssl/ssl/zuul]
- Cfssl::Cert[aux]
- Exec[Generate cert mlserve_staging refresh]
- Concat::Fragment[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]
- File[/lib/systemd/system/nrpe2nodexp-ferm_active.timer]
- Ferm::Service[ssh_from_cumin_masters]
- File[/etc/ferm/conf.d/10_bacula_file_daemon_backup1014_eqiad_wmnet]
- Logrotate::Conf[ulogd]
- Cfssl::Csr[/etc/cfssl/csr/syslog.csr]
- Exec[renew certificate - zuul]
- Sudo::User[nrpe-check_ferm_active]
- File[/etc/cfssl/csr/dse.csr]
- Cfssl::Cert[mlserve_staging_front_proxy]
- Cfssl::Cert[network_devices]
- Exec[Generate cert discovery2026 refresh]
- File[/etc/ferm/functions.conf]
- File[/etc/cfssl/ssl/mlserve_staging_front_proxy/mlserve_staging_front_proxy.csr]
- File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp]
- Ferm::Filter_log[filter-bootp]
- Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.service (wmf_auto_restart_ulogd2.service)]
- Concat::Fragment[/etc/bacula_puppet_ca_chain]
- Systemd::Unit[wmf_auto_restart_ulogd2.service]
- Class[Ulogd]
- Exec[Generate cert kafka]
- Sslcert::X509_to_pkcs12[puppet::expose_agent_cert: /etc/bacula]
- File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA_ocsp_signing_cert/Wikimedia_Internal_Root_CA_ocsp_signing_cert.pem]
- Cfssl::Cert[wikikube_staging_front_proxy]
- Monitoring::Exported_nagios_service[pki-root1002 ferm_active]
- Exec[renew certificate - aux_front_proxy]
- File[/etc/cfssl/csr/Wikimedia_Internal_Root_CA.csr]
- File[/etc/cfssl/ssl/aux_front_proxy]
- Rsyslog::Conf[ulogd]
- Service[ferm]
- File[/etc/cfssl/csr/cloud_wmnet_ca.csr]
- File[/etc/ulogd.conf]
- Cfssl::Csr[/etc/cfssl/csr/wikikube_staging_front_proxy.csr]
- File[/etc/cfssl/ssl/aux/aux.pem]
- Bacula::Client::Job[pki-root-cfssl-Monthly-1st-Wed-productionEqiad]
- File[/etc/cfssl/csr/debmonitor.csr]
- Firewall::Service[bacula-file-daemon-backup1014.eqiad.wmnet]
- Service[nrpe2nodexp-ferm_active.timer]
- Exec[renew certificate - wikikube_front_proxy]
- File[/etc/cfssl/ssl/wikikube/wikikube.pem]
- Cfssl::Csr[/etc/cfssl/csr/puppet_rsa.csr]
- Apt::Repository[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia]
- File[/etc/bacula/ssl/server.p12]
- Exec[Generate cert debmonitor]
- File[/etc/bacula/ssl/server-keypair.pem]
- File[/lib/systemd/system/nrpe2nodexp-ferm_active.service]
- Nrpe::Plugin[check_ferm]
- Cfssl::Cert[zuul]
- Nrpe::Check[check_ferm_active]
- File[/etc/cfssl/ssl/aux/aux.csr]
- Cfssl::Cert[syslog]
- Ferm::Service[full_monitoring_metrics_access_udp]
- Cfssl::Cert[mlserve_staging]
- File[/etc/cfssl/csr/aux_front_proxy.csr]
- File[/etc/cfssl/ssl/mlserve_staging]
- File[/etc/ferm/conf.d/01_drop-blocked-nets]
- File[/etc/cfssl/ssl/mlserve_front_proxy/mlserve_front_proxy-key.pem]
- File[/etc/systemd/system/ferm.service.d]
- File[/etc/cfssl/ssl/mlserve_front_proxy/mlserve_front_proxy.pem]
- File[/lib/systemd/system/wmf_auto_restart_ulogd2.service]
- File[/etc/cfssl/ssl/zuul/zuul-key.pem]
- File[/etc/cfssl/ssl/cassandra]
- Class[Profile::Firewall::Log::Ferm]
- Exec[Generate cert puppet refresh]
- Exec[Generate cert kafka refresh]
- Cfssl::Cert[mlserve]
- Motd::Message[pki::root]
- File[/etc/cfssl/ssl/puppet/puppet-key.pem]
- File[/etc/cfssl/ssl/network_devices]
- File[/etc/cfssl/csr/network_devices.csr]
- File[/etc/update-motd.d/05-pki--root]
- Ferm::Rule[dscp-default]
- Exec[Generate cert syslog]
- File[/etc/cfssl/csr/kafka.csr]
- Exec[Generate cert aux_front_proxy refresh]
- File[/etc/cfssl/ssl/wikikube_front_proxy]
- Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-status-restart)]
- File[/etc/update-motd.d/06-backups-pki-root-cfssl]
- File[/etc/cfssl/csr/wikikube.csr]
- File[/usr/local/lib/nagios/plugins/check_ferm]
- Exec[Generate cert mlserve_staging_front_proxy refresh]
- Cfssl::Csr[/etc/cfssl/csr/kafka.csr]
- File[/etc/cfssl/csr/mlserve_staging.csr]
- Exec[Generate cert wikikube_staging]
- File[/etc/cfssl/ssl/dse/dse-key.pem]
- Exec[renew certificate - mlserve_front_proxy]
- File[/etc/cfssl/csr/zuul.csr]
- File[/etc/cfssl/ssl/wikikube/wikikube-key.pem]
- Cfssl::Cert[kafka]
- Exec[renew certificate - mlserve_staging_front_proxy]
- File[/etc/cfssl/ssl/mlserve_staging/mlserve_staging.csr]
- Cfssl::Csr[/etc/cfssl/csr/zuul.csr]
Resources only in the old catalog
- File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft]
- File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft]
- File[/etc/nftables/sets/FRACK_NETWORKS_ipv6.nft]
- File[/etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft]
- Systemd::Service[nftables]
- File[/var/log/prometheus-node-textfile-check-nft]
- File[/etc/nftables/prerouting]
- File[/etc/nftables/sets/LABS_NETWORKS_ipv6.nft]
- Nftables::File[base]
- Nftables::Set[KAFKA_BROKERS_LOGGING]
- File[/etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft]
- File[/etc/nftables/forward]
- File[/etc/nftables/sets/NETWORK_INFRA_ipv6.nft]
- File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft]
- Rsyslog::Conf[prometheus-node-textfile-check-nft]
- File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft]
- File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft]
- File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft]
- Nftables::Set[DEPLOYMENT_HOSTS]
- File[/etc/nftables/sets]
- File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft]
- File[/etc/nftables/sets/MGMT_NETWORKS_ipv6.nft]
- Nftables::Set[KAFKAMON_HOSTS]
- File[/etc/nftables/sets/BASTION_HOSTS_ipv4.nft]
- File[/usr/local/bin/check-nft]
- File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft]
- File[/etc/nftables/postrouting]
- File[/etc/nftables/input/10_ssh-from-bastion.nft]
- File[/etc/logrotate.d/prometheus-node-textfile-check-nft]
- Nftables::Set[MLSERVE_KUBEPODS_NETWORKS]
- File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft]
- Nftables::Set[DRUID_PUBLIC_HOSTS]
- Class[Role::Insetup::Infrastructure_foundations_nftables]
- File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft]
- File[/etc/nftables/sets/NETWORK_INFRA_ipv4.nft]
- File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft]
- File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft]
- File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft]
- Systemd::Unmask[nftables.service]
- Nftables::Set[LINK_LOCAL]
- Nftables::Service[ssh-from-cumin-masters]
- File[/etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft]
- File[/etc/nftables.conf]
- File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft]
- Systemd::Service[prometheus-node-textfile-check-nft]
- File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft]
- File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft]
- File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft]
- File[/etc/nftables/sets/CACHES_ipv4.nft]
- File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft]
- File[/etc/systemd/system/nftables.service.d]
- Nftables::Set[MONITORING_HOSTS]
- File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft]
- Motd::Script[insetup::infrastructure_foundations_nftables]
- Service[nftables]
- File[/etc/nftables/sets/LINK_LOCAL_ipv4.nft]
- Nftables::Set[KAFKA_BROKERS_MAIN]
- Service[prometheus-node-textfile-check-nft.timer]
- File[/etc/nftables/sets/CUMIN_MASTERS_ipv4.nft]
- File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft]
- Nftables::Service[full-monitoring-metrics-access-udp]
- File[/etc/nftables/notrack]
- Class[Profile::Firewall::Nftables_base_sets]
- Systemd::Unit[prometheus-node-textfile-check-nft.service]
- Nftables::Set[LOAD_BALANCER_HEALTH_CHECKS]
- File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft]
- Systemd::Syslog[prometheus-node-textfile-check-nft]
- File[/etc/nftables/sets/CACHES_ipv6.nft]
- Logrotate::Conf[prometheus-node-textfile-check-nft]
- Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS]
- Nftables::Set[LABS_NETWORKS]
- File[/etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft]
- File[/etc/nftables/sets/MONITORING_HOSTS_ipv4.nft]
- File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft]
- File[/etc/nftables/sets/CUMIN_MASTERS_ipv6.nft]
- File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft]
- File[/lib/systemd/system/prometheus-node-textfile-check-nft.service]
- Nftables::Set[SANDBOX_NETWORKS]
- File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft]
- File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft]
- File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft]
- Nftables::Set[CUMIN_MASTERS]
- Nftables::Service[full-monitoring-metrics-access-tcp]
- Nftables::Set[PROMETHEUS_HOSTS]
- Nftables::Set[INTERNAL]
- Systemd::Unit[prometheus-node-textfile-check-nft.timer]
- File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft]
- File[/etc/nftables/main.nft]
- Nftables::Set[CLOUD_NETWORKS_PUBLIC]
- File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft]
- Nftables::Set[ZOOKEEPER_HOSTS_MAIN]
- File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft]
- Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.timer (prometheus-node-textfile-check-nft.timer)]
- Nftables::Service[ssh-from-bastion]
- Nftables::Set[BASTION_HOSTS]
- File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft]
- Nftables::Set[WIKIKUBE_KUBEPODS_NETWORKS]
- Exec[unmask_nftables.service]
- Nftables::Set[DOMAIN_NETWORKS]
- File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft]
- Nftables::Set[STAGING_KUBEPODS_NETWORKS]
- Nftables::Set[KAFKA_BROKERS_JUMBO]
- File[/etc/nftables/sets/INSTALL_HOSTS_ipv6.nft]
- File[/etc/nftables/sets/MONITORING_HOSTS_ipv6.nft]
- File[/etc/nftables/sets/LABS_NETWORKS_ipv4.nft]
- File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft]
- File[/etc/nftables/100_base_puppet.nft]
- Nftables::Set[ZOOKEEPER_FLINK_HOSTS]
- Nftables::Set[CACHES]
- File[/etc/nftables/input/10_ssh-from-cumin-masters.nft]
- File[/lib/systemd/system/prometheus-node-textfile-check-nft.timer]
- Class[Nftables]
- File[/etc/nftables/input]
- File[/etc/nftables/sets/LINK_LOCAL_ipv6.nft]
- File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft]
- Systemd::Unit[nftables]
- File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft]
- Nftables::Set[NETWORK_INFRA]
- Nftables::Set[PRODUCTION_NETWORKS]
- File[/etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf]
- File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft]
- File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft]
- File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft]
- Nftables::Set[CLOUD_PRIVATE_NETWORKS]
- Motd::Message[insetup::infrastructure_foundations_nftables]
- File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft]
- File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft]
- File[/etc/nftables/]
- Prometheus::Node_textfile[check-nft]
- File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft]
- File[/etc/nftables/sets/INTERNAL_ipv6.nft]
- File[/etc/nftables/output]
- File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft]
- File[/etc/nftables/input/10_full-monitoring-metrics-access-udp.nft]
- Nftables::Set[AUX_KUBEPODS_NETWORKS]
- File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft]
- File[/etc/nftables/sets/INTERNAL_ipv4.nft]
- Nftables::Set[FRACK_NETWORKS]
- File[/etc/update-motd.d/05-insetup--infrastructure-foundations-nftables]
- Systemd::Timer[prometheus-node-textfile-check-nft]
- File[/etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft]
- Systemd::Timer::Job[prometheus-node-textfile-check-nft]
- Nftables::Set[MW_APPSERVER_NETWORKS]
- Exec[systemd daemon-reload for nftables.service (nftables)]
- File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft]
- File[/etc/nftables/sets/INSTALL_HOSTS_ipv4.nft]
- File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft]
- Nftables::Set[INSTALL_HOSTS]
- File[/etc/systemd/system/nftables.service.d/puppet-override.conf]
- File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft]
- Nftables::Set[MYSQL_ROOT_CLIENTS]
- Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.service (prometheus-node-textfile-check-nft.service)]
- Nftables::Set[DSE_KUBEPODS_NETWORKS]
- Nftables::Set[LABSTORE_HOSTS]
- File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft]
- Node[__node_regexp__pki-root1002.eqiad.]
- File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft]
- Package[nftables]
- File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft]
- File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft]
- File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft]
- Nftables::Set[CLOUD_NETWORKS]
- Nftables::Set[MGMT_NETWORKS]
- Nftables::Set[ANALYTICS_NETWORKS]
- File[/etc/nftables/sets/BASTION_HOSTS_ipv6.nft]
Resources modified
- File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft]
- Parameters differences:
--- File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft].orig +++ File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft] - notify => ['Service[nftables]'] - mode => 0444 - group => root - ensure => present - tag => nft - owner => root
- Content differences:
--- /etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft.orig +++ /etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft @@ -1,183 +0,0 @@ -# Autogenerated by puppet -set PRODUCTION_NETWORKS_ipv6 { - type ipv6_addr - flags interval - auto-merge - elements = { 2001:df2:e500:101::/64, - 2001:df2:e500:103::/64, - 2001:df2:e500:1::/64, - 2001:df2:e500:3::/64, - 2001:df2:e500:ed1a::/64, - 2620:0:860:100::/64, - 2620:0:860:101::/64, - 2620:0:860:102::/64, - 2620:0:860:103::/64, - 2620:0:860:104::/64, - 2620:0:860:105::/64, - 2620:0:860:106::/64, - 2620:0:860:107::/64, - 2620:0:860:108::/64, - 2620:0:860:109::/64, - 2620:0:860:10a::/64, - 2620:0:860:10b::/64, - 2620:0:860:10c::/64, - 2620:0:860:10d::/64, - 2620:0:860:10e::/64, - 2620:0:860:10f::/64, - 2620:0:860:110::/64, - 2620:0:860:111::/64, - 2620:0:860:112::/64, - 2620:0:860:113::/64, - 2620:0:860:114::/64, - 2620:0:860:115::/64, - 2620:0:860:116::/64, - 2620:0:860:118::/64, - 2620:0:860:119::/64, - 2620:0:860:11a::/64, - 2620:0:860:11b::/64, - 2620:0:860:11c::/64, - 2620:0:860:11d::/64, - 2620:0:860:11e::/64, - 2620:0:860:11f::/64, - 2620:0:860:120::/64, - 2620:0:860:121::/64, - 2620:0:860:122::/64, - 2620:0:860:123::/64, - 2620:0:860:124::/64, - 2620:0:860:125::/64, - 2620:0:860:126::/64, - 2620:0:860:127::/64, - 2620:0:860:12b::/64, - 2620:0:860:12c::/64, - 2620:0:860:12d::/64, - 2620:0:860:12e::/64, - 2620:0:860:140::/64, - 2620:0:860:1::/64, - 2620:0:860:2::/64, - 2620:0:860:300::/64, - 2620:0:860:301::/64, - 2620:0:860:302::/64, - 2620:0:860:303::/64, - 2620:0:860:304::/64, - 2620:0:860:305::/64, - 2620:0:860:307::/64, - 2620:0:860:308::/64, - 2620:0:860:3::/64, - 2620:0:860:4::/64, - 2620:0:860:5::/64, - 2620:0:860:babe::/64, - 2620:0:860:babf::/64, - 2620:0:860:cabe::/64, - 2620:0:860:cabf::/64, - 2620:0:860:ed1a::/64, - 2620:0:861:100::/64, - 2620:0:861:101::/64, - 2620:0:861:102::/64, - 2620:0:861:103::/64, - 2620:0:861:104::/64, - 2620:0:861:105::/64, - 2620:0:861:106::/64, - 2620:0:861:107::/64, - 2620:0:861:108::/64, - 2620:0:861:109::/64, - 2620:0:861:10a::/64, - 2620:0:861:10b::/64, - 2620:0:861:10c::/64, - 2620:0:861:10d::/64, - 2620:0:861:10e::/64, - 2620:0:861:10f::/64, - 2620:0:861:110::/64, - 2620:0:861:111::/64, - 2620:0:861:112::/64, - 2620:0:861:113::/64, - 2620:0:861:114::/64, - 2620:0:861:115::/64, - 2620:0:861:116::/64, - 2620:0:861:117::/64, - 2620:0:861:118::/64, - 2620:0:861:119::/64, - 2620:0:861:11a::/64, - 2620:0:861:11c::/64, - 2620:0:861:11d::/64, - 2620:0:861:11e::/64, - 2620:0:861:11f::/64, - 2620:0:861:120::/64, - 2620:0:861:121::/64, - 2620:0:861:122::/64, - 2620:0:861:123::/64, - 2620:0:861:124::/64, - 2620:0:861:125::/64, - 2620:0:861:126::/64, - 2620:0:861:127::/64, - 2620:0:861:128::/64, - 2620:0:861:129::/64, - 2620:0:861:12a::/64, - 2620:0:861:12b::/64, - 2620:0:861:12c::/64, - 2620:0:861:12d::/64, - 2620:0:861:12e::/64, - 2620:0:861:12f::/64, - 2620:0:861:131::/64, - 2620:0:861:132::/64, - 2620:0:861:133::/64, - 2620:0:861:134::/64, - 2620:0:861:135::/64, - 2620:0:861:136::/64, - 2620:0:861:137::/64, - 2620:0:861:138::/64, - 2620:0:861:139::/64, - 2620:0:861:13a::/64, - 2620:0:861:13b::/64, - 2620:0:861:13c::/64, - 2620:0:861:13d::/64, - 2620:0:861:13e::/64, - 2620:0:861:13f::/64, - 2620:0:861:140::/64, - 2620:0:861:141::/64, - 2620:0:861:142::/64, - 2620:0:861:143::/64, - 2620:0:861:144::/64, - 2620:0:861:145::/64, - 2620:0:861:1::/64, - 2620:0:861:2::/64, - 2620:0:861:300::/64, - 2620:0:861:301::/116, - 2620:0:861:302::/64, - 2620:0:861:303::/116, - 2620:0:861:304::/116, - 2620:0:861:305::/64, - 2620:0:861:3::/64, - 2620:0:861:4::/64, - 2620:0:861:babe::/64, - 2620:0:861:babf::/116, - 2620:0:861:cabe::/64, - 2620:0:861:cabf::/116, - 2620:0:861:ed1a::/64, - 2620:0:863:101::/64, - 2620:0:863:102::/64, - 2620:0:863:103::/64, - 2620:0:863:1::/64, - 2620:0:863:2::/64, - 2620:0:863:3::/64, - 2620:0:863:ed1a::/64, - 2a02:ec80:300:101::/64, - 2a02:ec80:300:102::/64, - 2a02:ec80:300:103::/64, - 2a02:ec80:300:1::/64, - 2a02:ec80:300:2::/64, - 2a02:ec80:300:3::/64, - 2a02:ec80:300:ed1a::/64, - 2a02:ec80:600:101::/64, - 2a02:ec80:600:102::/64, - 2a02:ec80:600:1::/64, - 2a02:ec80:600:2::/64, - 2a02:ec80:600:ed1a::/64, - 2a02:ec80:700:101::/64, - 2a02:ec80:700:102::/64, - 2a02:ec80:700:103::/64, - 2a02:ec80:700:1::/64, - 2a02:ec80:700:2::/64, - 2a02:ec80:700:3::/64, - 2a02:ec80:700:ed1a::/64 - } -}- File[/etc/cfssl/csr/syslog.csr]
- Parameters differences:
--- File[/etc/cfssl/csr/syslog.csr].orig +++ File[/etc/cfssl/csr/syslog.csr] + ensure => file + mode => 0400 + owner => root + group => root
- Content differences:
--- /etc/cfssl/csr/syslog.csr.orig +++ /etc/cfssl/csr/syslog.csr @@ -0,0 +1,19 @@ +{ + "CN": "syslog", + "hosts": [ + "syslog" + ], + "key": { + "algo": "ecdsa", + "size": 521 + }, + "names": [ + { + "C": "US", + "L": "San Francisco", + "O": "Wikimedia Foundation, Inc", + "OU": "SRE Foundations", + "S": "California" + } + ] +}- Nftables::Set[MLSERVE_KUBEPODS_NETWORKS]
- Parameters differences:
--- Nftables::Set[MLSERVE_KUBEPODS_NETWORKS].orig +++ Nftables::Set[MLSERVE_KUBEPODS_NETWORKS] - ensure => present - hosts => ['10.67.16.0/21', '2620:0:861:300::/64', '10.194.16.0/21', '2620:0:860:300::/64']
- Exec[renew certificate - mlserve_staging]
- Parameters differences:
--- Exec[renew certificate - mlserve_staging].orig +++ Exec[renew certificate - mlserve_staging] + require => Exec[Generate cert mlserve_staging] + environment => ['GODEBUG=x509ignoreCN=0'] + command => /usr/bin/cfssl sign -ca=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca.pem -ca-key=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca-key.pem -config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf -db-config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/db.conf -profile intermediate /etc/cfssl/ssl/mlserve_staging/mlserve_staging.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/mlserve_staging/mlserve_staging + unless => /usr/bin/openssl x509 -in /etc/cfssl/ssl/mlserve_staging/mlserve_staging.pem -checkend 952200
- Exec[Generate cert aux refresh]
- Parameters differences:
--- Exec[Generate cert aux refresh].orig +++ Exec[Generate cert aux refresh] + subscribe => File[/etc/cfssl/csr/aux.csr] + refreshonly => True + environment => ['GODEBUG=x509ignoreCN=0'] + command => /usr/bin/cfssl gencert -ca=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca.pem -ca-key=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca-key.pem -config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf -db-config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/db.conf -profile intermediate /etc/cfssl/csr/aux.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/aux/aux
- File[/etc/cfssl/ssl/zuul/zuul.csr]
- Parameters differences:
--- File[/etc/cfssl/ssl/zuul/zuul.csr].orig +++ File[/etc/cfssl/ssl/zuul/zuul.csr] + ensure => file + mode => 0440 + owner => root + group => root
- Class[Profile::Cumin::Target]
- Parameters differences:
--- Class[Profile::Cumin::Target].orig +++ Class[Profile::Cumin::Target] @@ - cluster => insetup + cluster => pki
- File[/etc/cfssl/ssl/cloud_wmnet_ca/cloud_wmnet_ca.csr]
- Parameters differences:
--- File[/etc/cfssl/ssl/cloud_wmnet_ca/cloud_wmnet_ca.csr].orig +++ File[/etc/cfssl/ssl/cloud_wmnet_ca/cloud_wmnet_ca.csr] + ensure => file + mode => 0440 + owner => root + group => root
- Cfssl::Csr[/etc/cfssl/csr/aux.csr]
- Parameters differences:
--- Cfssl::Csr[/etc/cfssl/csr/aux.csr].orig +++ Cfssl::Csr[/etc/cfssl/csr/aux.csr] + ensure => present + common_name => aux + names => [{'organisation': 'Wikimedia Foundation, Inc', 'organisational_unit': 'SRE Foundations', 'locality': 'San Francisco', 'state': 'California', 'country': 'US'}] + key => {'algo': 'ecdsa', 'size': 521} + hosts => []- File[/etc/cfssl/ssl/debmonitor/debmonitor-key.pem]
- Parameters differences:
--- File[/etc/cfssl/ssl/debmonitor/debmonitor-key.pem].orig +++ File[/etc/cfssl/ssl/debmonitor/debmonitor-key.pem] + show_diff => False + mode => 0440 + backup => False + group => root + ensure => file + owner => root
- Class[Monitoring]
- Parameters differences:
--- Class[Monitoring].orig +++ Class[Monitoring] @@ - nagios_group => insetup_eqiad + nagios_group => pki_eqiad @@ - cluster => insetup + cluster => pki @@ - notifications_enabled => False + notifications_enabled => True
- File[/etc/cfssl/ssl/cassandra/cassandra-key.pem]
- Parameters differences:
--- File[/etc/cfssl/ssl/cassandra/cassandra-key.pem].orig +++ File[/etc/cfssl/ssl/cassandra/cassandra-key.pem] + show_diff => False + mode => 0440 + backup => False + group => root + ensure => file + owner => root
- File[/etc/ferm/conf.d/10_ssh_from_cumin_masters]
- Parameters differences:
--- File[/etc/ferm/conf.d/10_ssh_from_cumin_masters].orig +++ File[/etc/ferm/conf.d/10_ssh_from_cumin_masters] + require => File[/etc/ferm/conf.d] + notify => Service[ferm] + mode => 0400 + group => root + ensure => present + tag => ferm + owner => root
- Content differences:
--- /etc/ferm/conf.d/10_ssh_from_cumin_masters.orig +++ /etc/ferm/conf.d/10_ssh_from_cumin_masters @@ -0,0 +1,6 @@ +# Autogenerated by puppet. DO NOT EDIT BY HAND! +# +# +&R_SERVICE(tcp, 22, $CUMIN_MASTERS); + +
- Exec[Generate cert cassandra]
- Parameters differences:
--- Exec[Generate cert cassandra].orig +++ Exec[Generate cert cassandra] + require => Cfssl::Csr[/etc/cfssl/csr/cassandra.csr] + environment => ['GODEBUG=x509ignoreCN=0'] + command => /usr/bin/cfssl gencert -ca=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca.pem -ca-key=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca-key.pem -config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf -db-config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/db.conf -profile intermediate /etc/cfssl/csr/cassandra.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/cassandra/cassandra + unless => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/cassandra/cassandra.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/cassandra/cassandra-key.pem 2>&1)"
- File[/lib/systemd/system/prometheus-node-textfile-check-nft.service]
- Parameters differences:
--- File[/lib/systemd/system/prometheus-node-textfile-check-nft.service].orig +++ File[/lib/systemd/system/prometheus-node-textfile-check-nft.service] - notify => Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.service (prometheus-node-textfile-check-nft.service)] - mode => 0444 - group => root - ensure => present - owner => root
- Content differences:
--- /lib/systemd/system/prometheus-node-textfile-check-nft.service.orig +++ /lib/systemd/system/prometheus-node-textfile-check-nft.service @@ -1,8 +0,0 @@ -[Unit] -Description=Systemd timer to gather node metrics for check-nft -Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state - -[Service] -Type=oneshot -User=root -ExecStart=/usr/local/bin/check-nft
- Cfssl::Config[Wikimedia_Internal_Root_CA]
- Parameters differences:
--- Cfssl::Config[Wikimedia_Internal_Root_CA].orig +++ Cfssl::Config[Wikimedia_Internal_Root_CA] + default_ocsp_url => http://pki.discovery.wmnet/ocsp/Wikimedia_Internal_Root_CA + default_crl_url => http://pki.discovery.wmnet/crl/Wikimedia_Internal_Root_CA + profiles => {'intermediate': {'usages': ['cert sign', 'crl sign'], 'ca_constraint': {'is_ca': True, 'max_path_len': 1}, 'expiry': '43800h'}, 'ocsp': {'usages': ['digital signature', 'ocsp signing'], 'expiry': '43800h'}} + default_auth_key => default_auth + path => /etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf + default_auth_remote => {} + remotes => {} + ensure => present + default_usages => ['signing', 'key encipherment', 'client auth'] + default_expiry => 672h + auth_keys => {'default_auth': {'key': 'aaaabbbbccccdddd', 'type': 'standard'}}- File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA_ocsp_signing_cert/Wikimedia_Internal_Root_CA_ocsp_signing_cert.csr]
- Parameters differences:
--- File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA_ocsp_signing_cert/Wikimedia_Internal_Root_CA_ocsp_signing_cert.csr].orig +++ File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA_ocsp_signing_cert/Wikimedia_Internal_Root_CA_ocsp_signing_cert.csr] + ensure => file + mode => 0440 + owner => root + group => root
- File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft]
- Parameters differences:
--- File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft].orig +++ File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft] - notify => ['Service[nftables]'] - mode => 0444 - group => root - ensure => present - tag => nft - owner => root
- Content differences:
--- /etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft.orig +++ /etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft @@ -1,9 +0,0 @@ -# Autogenerated by puppet -set CLOUD_NETWORKS_PUBLIC_ipv6 { - type ipv6_addr - flags interval - auto-merge - elements = { 2a02:ec80:a000:4000::/64, - 2a02:ec80:a100:4000::/64 - } -}- Exec[renew certificate - puppet]
- Parameters differences:
--- Exec[renew certificate - puppet].orig +++ Exec[renew certificate - puppet] + require => Exec[Generate cert puppet] + environment => ['GODEBUG=x509ignoreCN=0'] + command => /usr/bin/cfssl sign -ca=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca.pem -ca-key=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca-key.pem -config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf -db-config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/db.conf -profile intermediate /etc/cfssl/ssl/puppet/puppet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet/puppet + unless => /usr/bin/openssl x509 -in /etc/cfssl/ssl/puppet/puppet.pem -checkend 952200
- File[/etc/cfssl/csr/wikikube_staging.csr]
- Parameters differences:
--- File[/etc/cfssl/csr/wikikube_staging.csr].orig +++ File[/etc/cfssl/csr/wikikube_staging.csr] + ensure => file + mode => 0400 + owner => root + group => root
- Content differences:
--- /etc/cfssl/csr/wikikube_staging.csr.orig +++ /etc/cfssl/csr/wikikube_staging.csr @@ -0,0 +1,19 @@ +{ + "CN": "wikikube_staging", + "hosts": [ + "wikikube_staging" + ], + "key": { + "algo": "ecdsa", + "size": 521 + }, + "names": [ + { + "C": "US", + "L": "San Francisco", + "O": "Wikimedia Foundation, Inc", + "OU": "SRE Foundations", + "S": "California" + } + ] +}- File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft]
- Parameters differences:
--- File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft].orig +++ File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft] - notify => ['Service[nftables]'] - mode => 0444 - group => root - ensure => present - tag => nft - owner => root
- Content differences:
--- /etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft.orig +++ /etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft @@ -1,11 +0,0 @@ -# Autogenerated by puppet -set MYSQL_ROOT_CLIENTS_ipv4 { - type ipv4_addr - elements = { 10.64.16.90, - 10.192.16.191, - 10.64.16.154, - 10.192.32.49, - 208.80.154.9, - 10.64.0.20 - } -}- Logrotate::Conf[wmf_auto_restart_ulogd2]
- Parameters differences:
--- Logrotate::Conf[wmf_auto_restart_ulogd2].orig +++ Logrotate::Conf[wmf_auto_restart_ulogd2] + ensure => present
- File[/etc/cfssl/ssl/dse_front_proxy]
- Parameters differences:
--- File[/etc/cfssl/ssl/dse_front_proxy].orig +++ File[/etc/cfssl/ssl/dse_front_proxy] + recurse => True + mode => 0740 + group => root + ensure => directory + owner => root
- Service[wmf_auto_restart_ulogd2.timer]
- Parameters differences:
--- Service[wmf_auto_restart_ulogd2.timer].orig +++ Service[wmf_auto_restart_ulogd2.timer] + ensure => running + provider => systemd + enable => True
- Exec[Generate cert wikikube_front_proxy refresh]
- Parameters differences:
--- Exec[Generate cert wikikube_front_proxy refresh].orig +++ Exec[Generate cert wikikube_front_proxy refresh] + subscribe => File[/etc/cfssl/csr/wikikube_front_proxy.csr] + refreshonly => True + environment => ['GODEBUG=x509ignoreCN=0'] + command => /usr/bin/cfssl gencert -ca=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca.pem -ca-key=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca-key.pem -config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf -db-config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/db.conf -profile intermediate /etc/cfssl/csr/wikikube_front_proxy.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/wikikube_front_proxy/wikikube_front_proxy
- Nftables::Set[CLOUD_NETWORKS]
- Parameters differences:
--- Nftables::Set[CLOUD_NETWORKS].orig +++ Nftables::Set[CLOUD_NETWORKS] - ensure => present - hosts => ['172.16.0.0/21', '172.16.128.0/24', '172.16.129.0/24', '172.16.130.0/24', '172.16.131.0/24', '172.16.16.0/21', '172.16.24.0/24', '172.16.8.0/21', '172.20.1.0/24', '172.20.2.0/24', '172.20.254.0/24', '172.20.255.0/24', '172.20.3.0/24', '172.20.4.0/24', '172.20.5.0/24', '185.15.56.0/25', '185.15.56.160/28', '185.15.57.0/29', '185.15.57.16/29', '185.15.57.24/29', '2a02:ec80:a000:100::/64', '2a02:ec80:a000:1::/64', '2a02:ec80:a000:201::/64', '2a02:ec80:a000:202::/64', '2a02:ec80:a000:203::/64', '2a02:ec80:a000:204::/64', '2a02:ec80:a000:2ff::/64', '2a02:ec80:a000:4000::/64', '2a02:ec80:a100:100::/64', '2a02:ec80:a100:1::/64', '2a02:ec80:a100:205::/64', '2a02:ec80:a100:2ff::/64', '2a02:ec80:a100:4000::/64']
- Alternatives::Select[ip6tables]
- Parameters differences:
--- Alternatives::Select[ip6tables].orig +++ Alternatives::Select[ip6tables] + path => /usr/sbin/ip6tables-legacy + require => Package[iptables]
- Cfssl::Csr[/etc/cfssl/csr/mlserve.csr]
- Parameters differences:
--- Cfssl::Csr[/etc/cfssl/csr/mlserve.csr].orig +++ Cfssl::Csr[/etc/cfssl/csr/mlserve.csr] + ensure => present + common_name => mlserve + names => [{'organisation': 'Wikimedia Foundation, Inc', 'organisational_unit': 'SRE Foundations', 'locality': 'San Francisco', 'state': 'California', 'country': 'US'}] + key => {'algo': 'ecdsa', 'size': 521} + hosts => []- File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft]
- Parameters differences:
--- File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft].orig +++ File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft] - notify => ['Service[nftables]'] - mode => 0444 - group => root - ensure => present - tag => nft - owner => root
- Content differences:
--- /etc/nftables/sets/MGMT_NETWORKS_ipv4.nft.orig +++ /etc/nftables/sets/MGMT_NETWORKS_ipv4.nft @@ -1,14 +0,0 @@ -# Autogenerated by puppet -set MGMT_NETWORKS_ipv4 { - type ipv4_addr - flags interval - auto-merge - elements = { 10.65.0.0/16, - 10.128.128.0/17, - 10.193.0.0/16, - 10.80.128.0/17, - 10.132.128.0/17, - 10.136.128.0/17, - 10.140.128.0/17 - } -}- File[/etc/cfssl/ssl/cassandra/cassandra.csr]
- Parameters differences:
--- File[/etc/cfssl/ssl/cassandra/cassandra.csr].orig +++ File[/etc/cfssl/ssl/cassandra/cassandra.csr] + ensure => file + mode => 0440 + owner => root + group => root
- File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft]
- Parameters differences:
--- File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft].orig +++ File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft] - notify => ['Service[nftables]'] - mode => 0444 - group => root - ensure => present - tag => nft - owner => root
- Content differences:
--- /etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft.orig +++ /etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft @@ -1,9 +0,0 @@ -# Autogenerated by puppet -set MLSERVE_KUBEPODS_NETWORKS_ipv6 { - type ipv6_addr - flags interval - auto-merge - elements = { 2620:0:861:300::/64, - 2620:0:860:300::/64 - } -}- Exec[renew certificate - puppet_rsa]
- Parameters differences:
--- Exec[renew certificate - puppet_rsa].orig +++ Exec[renew certificate - puppet_rsa] + require => Exec[Generate cert puppet_rsa] + environment => ['GODEBUG=x509ignoreCN=0'] + command => /usr/bin/cfssl sign -ca=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca.pem -ca-key=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca-key.pem -config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf -db-config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/db.conf -profile intermediate /etc/cfssl/ssl/puppet_rsa/puppet_rsa.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/puppet_rsa/puppet_rsa + unless => /usr/bin/openssl x509 -in /etc/cfssl/ssl/puppet_rsa/puppet_rsa.pem -checkend 952200
- Nftables::Service[ssh-from-cumin-masters]
- Parameters differences:
--- Nftables::Service[ssh-from-cumin-masters].orig +++ Nftables::Service[ssh-from-cumin-masters] - src_sets => ['CUMIN_MASTERS'] - desc => - prio => 10 - proto => tcp - unrestricted_access => False - notrack => False - ensure => present - port => 22
- Nftables::Set[LABS_NETWORKS]
- Parameters differences:
--- Nftables::Set[LABS_NETWORKS].orig +++ Nftables::Set[LABS_NETWORKS] - ensure => present - hosts => ['172.16.0.0/21', '172.16.128.0/24', '172.16.129.0/24', '172.16.130.0/24', '172.16.131.0/24', '172.16.16.0/21', '172.16.24.0/24', '172.16.8.0/21', '172.20.1.0/24', '172.20.2.0/24', '172.20.254.0/24', '172.20.255.0/24', '172.20.3.0/24', '172.20.4.0/24', '172.20.5.0/24', '185.15.56.0/25', '185.15.56.160/28', '185.15.57.0/29', '185.15.57.16/29', '185.15.57.24/29', '2a02:ec80:a000:100::/64', '2a02:ec80:a000:1::/64', '2a02:ec80:a000:201::/64', '2a02:ec80:a000:202::/64', '2a02:ec80:a000:203::/64', '2a02:ec80:a000:204::/64', '2a02:ec80:a000:2ff::/64', '2a02:ec80:a000:4000::/64', '2a02:ec80:a100:100::/64', '2a02:ec80:a100:1::/64', '2a02:ec80:a100:205::/64', '2a02:ec80:a100:2ff::/64', '2a02:ec80:a100:4000::/64']
- File[/etc/cfssl/ssl/network_devices/network_devices.csr]
- Parameters differences:
--- File[/etc/cfssl/ssl/network_devices/network_devices.csr].orig +++ File[/etc/cfssl/ssl/network_devices/network_devices.csr] + ensure => file + mode => 0440 + owner => root + group => root
- Exec[Generate cert wikikube_staging refresh]
- Parameters differences:
--- Exec[Generate cert wikikube_staging refresh].orig +++ Exec[Generate cert wikikube_staging refresh] + subscribe => File[/etc/cfssl/csr/wikikube_staging.csr] + refreshonly => True + environment => ['GODEBUG=x509ignoreCN=0'] + command => /usr/bin/cfssl gencert -ca=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca.pem -ca-key=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca-key.pem -config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf -db-config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/db.conf -profile intermediate /etc/cfssl/csr/wikikube_staging.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/wikikube_staging/wikikube_staging
- Service[ulogd2]
- Parameters differences:
--- Service[ulogd2].orig +++ Service[ulogd2] + ensure => running + require => Package[ulogd2] + enable => True
- Class[Profile::Contacts]
- Parameters differences:
--- Class[Profile::Contacts].orig +++ Class[Profile::Contacts] @@ - cluster => insetup + cluster => pki
- Nftables::Set[ZOOKEEPER_FLINK_HOSTS]
- Parameters differences:
--- Nftables::Set[ZOOKEEPER_FLINK_HOSTS].orig +++ Nftables::Set[ZOOKEEPER_FLINK_HOSTS] - ensure => present - hosts => ['10.64.16.9', '2620:0:861:102:10:64:16:9', '10.64.0.8', '2620:0:861:101:10:64:0:8', '10.64.32.41', '2620:0:861:103:10:64:32:41', '10.192.16.227', '2620:0:860:102:10:192:16:227', '10.192.32.179', '2620:0:860:103:10:192:32:179', '10.192.48.219', '2620:0:860:104:10:192:48:219']
- Concat_fragment[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]
- Parameters differences:
--- Concat_fragment[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia-header].orig +++ Concat_fragment[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia-header] + tag => _etc_apt_sources.list.d_component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources + source => puppet:///modules/apt/sources-deb822-header.txt + order => 01 + target => /etc/apt/sources.list.d/component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources
- Concat[/etc/bacula/ssl/cert.pem]
- Parameters differences:
--- Concat[/etc/bacula/ssl/cert.pem].orig +++ Concat[/etc/bacula/ssl/cert.pem] + show_diff => True + backup => puppet + replace => True + format => plain + ensure_newline => False + force => False + path => /etc/bacula/ssl/cert.pem + warn => False + mode => 0644 + ensure => present + order => alpha
- File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft]
- Parameters differences:
--- File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft].orig +++ File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft] - notify => ['Service[nftables]'] - mode => 0444 - group => root - ensure => present - tag => nft - owner => root
- Content differences:
--- /etc/nftables/sets/FRACK_NETWORKS_ipv4.nft.orig +++ /etc/nftables/sets/FRACK_NETWORKS_ipv4.nft @@ -1,22 +0,0 @@ -# Autogenerated by puppet -set FRACK_NETWORKS_ipv4 { - type ipv4_addr - flags interval - auto-merge - elements = { 10.195.0.0/27, - 10.195.0.128/29, - 10.195.0.32/27, - 10.195.0.64/28, - 10.195.0.80/29, - 10.195.0.96/27, - 10.195.1.0/25, - 10.64.40.0/27, - 10.64.40.160/27, - 10.64.40.192/26, - 10.64.40.32/27, - 10.64.40.64/27, - 10.64.40.96/27, - 208.80.152.224/28, - 208.80.155.0/27 - } -}- File[/etc/apt/sources.list.d/component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia.list]
- Parameters differences:
--- File[/etc/apt/sources.list.d/component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia.list].orig +++ File[/etc/apt/sources.list.d/component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia.list] + ensure => absent + owner => root + group => root
- File[/etc/cfssl/ssl/wikikube_staging_front_proxy]
- Parameters differences:
--- File[/etc/cfssl/ssl/wikikube_staging_front_proxy].orig +++ File[/etc/cfssl/ssl/wikikube_staging_front_proxy] + recurse => True + mode => 0740 + group => root + ensure => directory + owner => root
- File[/etc/cfssl/csr/aux.csr]
- Parameters differences:
--- File[/etc/cfssl/csr/aux.csr].orig +++ File[/etc/cfssl/csr/aux.csr] + ensure => file + mode => 0400 + owner => root + group => root
- Content differences:
--- /etc/cfssl/csr/aux.csr.orig +++ /etc/cfssl/csr/aux.csr @@ -0,0 +1,19 @@ +{ + "CN": "aux", + "hosts": [ + "aux" + ], + "key": { + "algo": "ecdsa", + "size": 521 + }, + "names": [ + { + "C": "US", + "L": "San Francisco", + "O": "Wikimedia Foundation, Inc", + "OU": "SRE Foundations", + "S": "California" + } + ] +}- File[/etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft]
- Parameters differences:
--- File[/etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft].orig +++ File[/etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft] - notify => ['Service[nftables]'] - mode => 0444 - group => root - ensure => present - tag => nft - owner => root
- Content differences:
--- /etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft.orig +++ /etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft @@ -1,27 +0,0 @@ -# Autogenerated by puppet -set CLOUD_NETWORKS_ipv4 { - type ipv4_addr - flags interval - auto-merge - elements = { 172.16.0.0/21, - 172.16.128.0/24, - 172.16.129.0/24, - 172.16.130.0/24, - 172.16.131.0/24, - 172.16.16.0/21, - 172.16.24.0/24, - 172.16.8.0/21, - 172.20.1.0/24, - 172.20.2.0/24, - 172.20.254.0/24, - 172.20.255.0/24, - 172.20.3.0/24, - 172.20.4.0/24, - 172.20.5.0/24, - 185.15.56.0/25, - 185.15.56.160/28, - 185.15.57.0/29, - 185.15.57.16/29, - 185.15.57.24/29 - } -}- File[/etc/systemd/system/nftables.service.d/puppet-override.conf]
- Parameters differences:
--- File[/etc/systemd/system/nftables.service.d/puppet-override.conf].orig +++ File[/etc/systemd/system/nftables.service.d/puppet-override.conf] - notify => Exec[systemd daemon-reload for nftables.service (nftables)] - mode => 0444 - group => root - ensure => present - owner => root
- Content differences:
--- /etc/systemd/system/nftables.service.d/puppet-override.conf.orig +++ /etc/systemd/system/nftables.service.d/puppet-override.conf @@ -1,5 +0,0 @@ -[Service] -ExecStart= -ExecStart=/usr/sbin/nft -f /etc/nftables/main.nft -ExecReload= -ExecReload=/usr/sbin/nft -f /etc/nftables/main.nft
- Cfssl::Cert[dse_front_proxy]
- Parameters differences:
--- Cfssl::Cert[dse_front_proxy].orig +++ Cfssl::Cert[dse_front_proxy] + notify_services => [] + key => {'algo': 'ecdsa', 'size': 521} + signer_config => {'config_dir': '/etc/cfssl/signers/Wikimedia_Internal_Root_CA'} + common_name => dse_front_proxy + owner => root + profile => intermediate + mode => 0740 + ensure => present + names => [{'organisation': 'Wikimedia Foundation, Inc', 'organisational_unit': 'SRE Foundations', 'locality': 'San Francisco', 'state': 'California', 'country': 'US'}] + provide_chain => False + require => Cfssl::Signer[Wikimedia_Internal_Root_CA] + before_services => [] + group => root + renew_seconds => 952200 + environment => ['GODEBUG=x509ignoreCN=0'] + auto_renew => True + hosts => []- Exec[Generate cert mlserve_staging]
- Parameters differences:
--- Exec[Generate cert mlserve_staging].orig +++ Exec[Generate cert mlserve_staging] + require => Cfssl::Csr[/etc/cfssl/csr/mlserve_staging.csr] + environment => ['GODEBUG=x509ignoreCN=0'] + command => /usr/bin/cfssl gencert -ca=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca.pem -ca-key=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca/ca-key.pem -config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf -db-config=/etc/cfssl/signers/Wikimedia_Internal_Root_CA/db.conf -profile intermediate /etc/cfssl/csr/mlserve_staging.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/mlserve_staging/mlserve_staging + unless => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/mlserve_staging/mlserve_staging.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/mlserve_staging/mlserve_staging-key.pem 2>&1)"
- Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS]
- Parameters differences:
--- Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS].orig +++ Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS] - ensure => present - hosts => ['10.194.61.0/24', '2620:0:860:302::/64']
- Class[Profile::Base]
- Class[Profile::Base]
- Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS]
- Exec[Generate cert mlserve_staging]
- Content differences:
- Content differences:
- Content differences:
- File[/etc/cfssl/csr/aux.csr]
- File[/etc/cfssl/ssl/wikikube_staging_front_proxy]
- Content differences:
- File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft]
- Concat[/etc/bacula/ssl/cert.pem]
- Concat_fragment[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]
- Nftables::Set[ZOOKEEPER_FLINK_HOSTS]
- Class[Profile::Contacts]
- Service[ulogd2]
- Exec[Generate cert wikikube_staging refresh]
- File[/etc/cfssl/ssl/network_devices/network_devices.csr]
- Nftables::Set[LABS_NETWORKS]
- Nftables::Service[ssh-from-cumin-masters]
- Content differences:
- File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft]
- Content differences:
- File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft]
- Cfssl::Csr[/etc/cfssl/csr/mlserve.csr]
- Alternatives::Select[ip6tables]
- Nftables::Set[CLOUD_NETWORKS]
- Exec[Generate cert wikikube_front_proxy refresh]
- Service[wmf_auto_restart_ulogd2.timer]
- File[/etc/cfssl/ssl/dse_front_proxy]
- Content differences:
- Content differences:
- File[/etc/cfssl/csr/wikikube_staging.csr]
- Content differences:
- File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft]
- File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA_ocsp_signing_cert/Wikimedia_Internal_Root_CA_ocsp_signing_cert.csr]
- Content differences:
- File[/lib/systemd/system/prometheus-node-textfile-check-nft.service]
- Content differences:
- File[/etc/ferm/conf.d/10_ssh_from_cumin_masters]
- File[/etc/cfssl/ssl/cassandra/cassandra-key.pem]
- Class[Monitoring]
- File[/etc/cfssl/ssl/debmonitor/debmonitor-key.pem]
- Cfssl::Csr[/etc/cfssl/csr/aux.csr]
- File[/etc/cfssl/ssl/cloud_wmnet_ca/cloud_wmnet_ca.csr]
- Class[Profile::Cumin::Target]
- File[/etc/cfssl/ssl/zuul/zuul.csr]
- Exec[Generate cert aux refresh]
- Exec[renew certificate - mlserve_staging]
- Content differences:
- Content differences:
- Parameters differences: