Compilation results for pki-root1002.eqiad.wmnet: System changes detected

Catalog differences

Summary

Resources only in the new catalog

• Service[bacula-fd]
• File[/etc/cfssl/ssl/etcd/etcd-key.pem]
• File[/etc/cfssl/ssl/aux_front_proxy/aux_front_proxy.csr]
• Cfssl::Signer[Wikimedia_Internal_Root_CA]
• File[/etc/cfssl/ssl/discovery2026/discovery2026.csr]
• Cfssl::Csr[/etc/cfssl/csr/puppet.csr]
• Systemd::Timer[wmf_auto_restart_ulogd2]
• File[/etc/cfssl/ssl/mlserve_front_proxy/mlserve_front_proxy.csr]
• Concat_file[/etc/bacula/ssl/cert.pem]
• Exec[renew certificate - wikikube_staging_front_proxy]
• File[/etc/cfssl/csr/syslog.csr]
• Prometheus::Alert::Rule[check_ferm_active_bba0a2572329bb500b832470e08b381c]
• Exec[renew certificate - mlserve_staging]
• Exec[Generate cert aux refresh]
• Ferm::Rule[drop-blocked-nets]
• Package[ulogd2]
• File[/etc/cfssl/ssl/zuul/zuul.csr]
• Apt::Package_from_component[bacula-trixie]
• Exec[Generate cert aux_front_proxy]
• Exec[Generate cert wikikube_staging_front_proxy]
• File[/etc/cfssl/ssl/cloud_wmnet_ca/cloud_wmnet_ca.csr]
• Cfssl::Csr[/etc/cfssl/csr/aux.csr]
• File[/var/log/wmf_auto_restart_ulogd2]
• File[/etc/cfssl/ssl/wikikube_staging/wikikube_staging-key.pem]
• Exec[renew certificate - Wikimedia_Internal_Root_CA_ocsp_signing_cert]
• File[/etc/cfssl/ssl/debmonitor/debmonitor-key.pem]
• Exec[Generate cert wikikube refresh]
• Cfssl::Csr[/etc/cfssl/csr/network_devices.csr]
• Exec[update_alternative_iptables]
• Cfssl::Csr[/etc/cfssl/csr/mlserve_staging.csr]
• File[/etc/cfssl/ssl/wikikube_front_proxy/wikikube_front_proxy-key.pem]
• File[/etc/cfssl/signers/Wikimedia_Internal_Root_CA/db.conf]
• File[/etc/cfssl/ssl/cassandra/cassandra-key.pem]
• Exec[Generate cert mlserve]
• Ferm::Rule[log-everything]
• Systemd::Service[wmf_auto_restart_ulogd2]
• File[/etc/cfssl/csr/cassandra.csr]
• File[/etc/cfssl/ssl/syslog/syslog.csr]
• File[/etc/ferm/conf.d/98_log-everything]
• Cfssl::Csr[/etc/cfssl/csr/Wikimedia_Internal_Root_CA.csr]
• File[/etc/ferm/conf.d/10_ssh_from_cumin_masters]
• Exec[Generate cert cassandra]
• File[/etc/cfssl/ssl/mlserve_staging_front_proxy/mlserve_staging_front_proxy.pem]
• Cfssl::Config[Wikimedia_Internal_Root_CA]
• File[/etc/cfssl/ssl/discovery2026]
• Exec[renew certificate - cloud_wmnet_ca]
• File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA_ocsp_signing_cert/Wikimedia_Internal_Root_CA_ocsp_signing_cert.csr]
• Exec[Generate cert cloud_wmnet_ca]
• Exec[renew certificate - puppet]
• Exec[Generate cert zuul]
• Exec[renew certificate - wikikube]
• File[/etc/cfssl/csr/wikikube_staging.csr]
• File[/etc/cfssl/ssl/mlserve/mlserve.csr]
• Cfssl::Csr[/etc/cfssl/csr/discovery2026.csr]
• Exec[Generate cert etcd refresh]
• Logrotate::Conf[wmf_auto_restart_ulogd2]
• File[/etc/cfssl/ssl/dse]
• File[/etc/cfssl/ssl/puppet/puppet.pem]
• File[/etc/cfssl/ssl/cloud_wmnet_ca/cloud_wmnet_ca-key.pem]
• Exec[Generate cert Wikimedia_Internal_Root_CA_ocsp_signing_cert refresh]
• Cfssl::Cert[mlserve_front_proxy]
• Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.service (nrpe2nodexp-ferm_active.service)]
• Systemd::Unit[wmf_auto_restart_ulogd2.timer]
• File[/etc/cfssl/ssl/dse_front_proxy]
• File[/etc/cfssl/ssl/network_devices/network_devices-key.pem]
• Service[wmf_auto_restart_ulogd2.timer]
• File[/etc/cfssl/ssl/wikikube_staging_front_proxy/wikikube_staging_front_proxy-key.pem]
• Exec[Generate cert cassandra refresh]
• Exec[Generate cert wikikube]
• File[/etc/sudoers.d/nrpe-check_ferm_active]
• Cfssl::Cert[cloud_wmnet_ca]
• Ferm::Service[ssh_from_bastion]
• File[/etc/cfssl/ssl/mlserve]
• Concat_file[/etc/apt/sources.list.d/component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]
• File[/etc/bacula/bacula-fd.conf]
• File[/etc/bacula/ssl/server.key]
• File[/etc/cfssl/ssl/cloud_wmnet_ca/cloud_wmnet_ca.pem]
• File[/etc/bacula/ssl]
• Exec[Generate cert dse]
• Cfssl::Cert[puppet_rsa]
• File[/etc/cfssl/ssl/mlserve/mlserve-key.pem]
• Exec[Generate cert mlserve_staging_front_proxy]
• Exec[Generate cert mlserve refresh]
• Exec[Generate cert wikikube_front_proxy refresh]
• File[/etc/cfssl/ssl/aux_front_proxy/aux_front_proxy-key.pem]
• Exec[Generate cert dse_front_proxy]
• Cfssl::Csr[/etc/cfssl/csr/cloud_wmnet_ca.csr]
• Class[Profile::Pki::Root_ca]
• Alternatives::Select[ip6tables]
• Concat[/etc/apt/sources.list.d/component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia.sources]
• Cfssl::Csr[/etc/cfssl/csr/mlserve.csr]
• Systemd::Timer::Job[wmf_auto_restart_ulogd2]
• Motd::Script[pki::root]
• File[/etc/cfssl/csr/Wikimedia_Internal_Root_CA_ocsp_signing_cert.csr]
• File[/etc/cfssl/ssl/syslog/syslog-key.pem]
• File[/etc/cfssl/ssl/cassandra/cassandra.csr]
• File[/etc/cfssl/ssl/mlserve_staging_front_proxy]
• Exec[apt_repository_component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia]
• Cfssl::Csr[/etc/cfssl/csr/dse.csr]
• Profile::Auto_restarts::Service[ulogd2]
• File[/etc/cfssl/ssl/kafka/kafka.pem]
• File[/etc/ferm/conf.d/02_main]
• Exec[Generate cert cloud_wmnet_ca refresh]
• Exec[renew certificate - puppet_rsa]
• File[/etc/cfssl/csr/mlserve.csr]
• File[/etc/cfssl/ssl/syslog]
• Concat_fragment[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia]
• File[/etc/cfssl/ssl/wikikube_staging/wikikube_staging.pem]
• File[/etc/systemd/system/ferm.service.d/ferm-service-status-restart.conf]
• File[/etc/cfssl/ssl/cloud_wmnet_ca]
• File[/etc/cfssl/ssl/wikikube_front_proxy/wikikube_front_proxy.pem]
• Exec[Generate cert wikikube_staging_front_proxy refresh]
• Systemd::Timer::Job[nrpe2nodexp-ferm_active]
• File[/etc/cfssl/ssl/wikikube_staging]
• Cfssl::Cert[etcd]
• File[/etc/cfssl/csr/discovery2026.csr]
• Cfssl::Csr[/etc/cfssl/csr/debmonitor.csr]
• Exec[Generate cert debmonitor refresh]
• File[/etc/rsyslog.d/40-ulogd.conf]
• File[/etc/cfssl/ssl/mlserve_staging/mlserve_staging.pem]
• Cfssl::Cert[wikikube_front_proxy]
• Concat_fragment[/etc/bacula_puppet_ca_chain]
• Systemd::Service[nrpe2nodexp-ferm_active]
• Exec[renew certificate - kafka]
• File[/etc/cfssl/ssl/wikikube]
• File[/etc/cfssl/ssl/aux/aux-key.pem]
• File[/etc/cfssl/ssl/puppet_rsa/puppet_rsa.csr]
• File[/etc/cfssl/ssl/wikikube_staging_front_proxy/wikikube_staging_front_proxy.pem]
• Cfssl::Cert[dse]
• Package[bacula-common]
• Exec[Generate cert network_devices refresh]
• File[/etc/ferm/conf.d]
• File[/etc/cfssl/ssl/mlserve_front_proxy]
• File[/etc/cfssl/ssl/dse_front_proxy/dse_front_proxy.pem]
• File[/etc/cfssl/ssl/network_devices/network_devices.csr]
• File[/etc/cfssl/ssl/network_devices/network_devices.pem]
• Motd::Script[backups-pki-root-cfssl]
• Exec[Generate cert puppet_rsa]
• Ferm::Conf[defs]
• File[/etc/cfssl/csr/puppet.csr]
• File_line[auto_restart_file_presence_ulogd2]
• Class[Profile::Backup::Host]
• File[/etc/ferm/conf.d/98_filter_log_filter-bootp]
• Exec[Generate cert Wikimedia_Internal_Root_CA_ocsp_signing_cert]
• Cfssl::Cert[wikikube]
• Exec[Generate cert wikikube_staging refresh]
• Cfssl::Csr[/etc/cfssl/csr/cassandra.csr]
• Service[ulogd2]
• File[/etc/cfssl/ssl/debmonitor]
• File[/etc/cfssl/ssl/wikikube_staging/wikikube_staging.csr]
• Systemd::Unit[nrpe2nodexp-ferm_active.timer]
• File[/lib/systemd/system/wmf_auto_restart_ulogd2.timer]
• File[/etc/cfssl/csr/mlserve_staging_front_proxy.csr]
• Concat_fragment[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]
• File[/etc/ferm/conf.d/00_defs]
• File[/etc/cfssl/ssl/aux_front_proxy/aux_front_proxy.pem]
• File[/etc/cfssl/csr/puppet_rsa.csr]
• File[/etc/cfssl/ssl/mlserve_staging_front_proxy/mlserve_staging_front_proxy-key.pem]
• Concat[/etc/bacula/ssl/cert.pem]
• Exec[systemd daemon-reload for nrpe2nodexp-ferm_active.timer (nrpe2nodexp-ferm_active.timer)]
• Exec[renew certificate - mlserve]
• File[/etc/cfssl/ssl/cassandra/cassandra.pem]
• File[/etc/cfssl/ssl/mlserve/mlserve.pem]
• File[/etc/apt/sources.list.d/component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia.list]
• File[/etc/cfssl/ssl/wikikube_staging_front_proxy]
• File[/etc/cfssl/ssl/etcd/etcd.csr]
• Exec[renew certificate - debmonitor]
• File[/etc/cfssl/csr/aux.csr]
• File[/etc/cfssl/ssl/puppet_rsa]
• Cfssl::Cert[wikikube_staging]
• Systemd::Timer[nrpe2nodexp-ferm_active]
• Exec[Generate cert wikikube_front_proxy]
• Backup::Set[pki-root-cfssl]
• Concat::Fragment[/etc/bacula_puppet_agent_cert]
• Node[__node_regexp__pki-root10012.eqiad.]
• File[/etc/logrotate.d/ulogd]
• Class[Role::Pki::Root]
• File[/etc/cfssl/ssl/syslog/syslog.pem]
• File[/etc/cfssl/ssl/mlserve_staging/mlserve_staging-key.pem]
• Exec[Generate cert puppet_rsa refresh]
• Cfssl::Csr[/etc/cfssl/csr/dse_front_proxy.csr]
• Exec[Generate cert mlserve_front_proxy refresh]
• Concat_fragment[/etc/bacula_puppet_agent_cert]
• Class[Bacula::Client]
• Exec[Generate cert aux]
• Rsyslog::Conf[wmf_auto_restart_ulogd2]
• File[/etc/cfssl/signers/Wikimedia_Internal_Root_CA/cfssl.conf]
• Exec[renew certificate - wikikube_staging]
• File[/etc/cfssl/ssl/kafka/kafka.csr]
• Exec[apt_package_from_component_bacula-trixie]
• Exec[Generate cert network_devices]
• Exec[Generate cert mlserve_front_proxy]
• File[/etc/nagios/nrpe.d/check_ferm_active.cfg]
• Rsyslog::Conf[nrpe2nodexp-ferm_active]
• Cfssl::Cert[dse_front_proxy]
• Cfssl::Cert[Wikimedia_Internal_Root_CA_ocsp_signing_cert]
• File[/etc/cfssl/ssl/wikikube_front_proxy/wikikube_front_proxy.csr]
• Exec[Generate cert puppet]
• File[/etc/cfssl/ssl/discovery2026/discovery2026-key.pem]
• File[/etc/cfssl/ssl/puppet_rsa/puppet_rsa.pem]
• Cfssl::Csr[/etc/cfssl/csr/wikikube_front_proxy.csr]
• Exec[Generate cert mlserve_staging]
• Ferm::Conf[main]
• File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA_ocsp_signing_cert/Wikimedia_Internal_Root_CA_ocsp_signing_cert-key.pem]
• File[/etc/cfssl/ssl/kafka/kafka-key.pem]
• Cfssl::Csr[/etc/cfssl/csr/wikikube_staging.csr]
• File[/etc/cfssl/ssl/dse/dse.csr]
• Exec[renew certificate - syslog]
• Exec[Generate cert discovery2026]
• Alternatives::Select[iptables]
• File[/etc/cfssl/csr/mlserve_front_proxy.csr]
• Systemd::Override[ferm-service-status-restart]
• Cfssl::Cert[puppet]
• File[/etc/cfssl/ssl/discovery2026/discovery2026.pem]
• File[/etc/cfssl/csr/wikikube_staging_front_proxy.csr]
• Cfssl::Csr[/etc/cfssl/csr/aux_front_proxy.csr]
• File[/var/log/ulogd]
• Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.timer (wmf_auto_restart_ulogd2.timer)]
• File[/etc/ferm/conf.d/10_ssh_from_bastion]
• Cfssl::Csr[/etc/cfssl/csr/mlserve_front_proxy.csr]
• Exec[renew certificate - etcd]
• File[/etc/cfssl/csr/wikikube_front_proxy.csr]
• Cfssl::Cert[discovery2026]
• File[/etc/cfssl/ssl/dse/dse.pem]
• Cfssl::Cert[aux_front_proxy]
• Exec[renew certificate - discovery2026]
• Systemd::Syslog[ulogd]
• Exec[renew certificate - aux]
• File[/etc/cfssl/ssl/puppet_rsa/puppet_rsa-key.pem]
• Monitoring::Service[ferm_active]
• Exec[update_alternative_ip6tables]
• File[/etc/cfssl/ssl/dse_front_proxy/dse_front_proxy.csr]
• Systemd::Unit[ferm-ferm-service-status-restart]
• File[/etc/cfssl/signers/Wikimedia_Internal_Root_CA/ca]
• Cfssl::Csr[/etc/cfssl/csr/Wikimedia_Internal_Root_CA_ocsp_signing_cert.csr]
• Ferm::Service[bacula_file_daemon_backup1014_eqiad_wmnet]
• File[/etc/cfssl/ssl/kafka]
• File[/etc/ferm/conf.d/99_dscp-default]
• File[/etc/cfssl/ssl/puppet]
• Systemd::Unit[nrpe2nodexp-ferm_active.service]
• File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA_ocsp_signing_cert]
• File[/etc/default/ferm]
• Cfssl::Db[Wikimedia_Internal_Root_CA]
• File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_udp]
• Package[bacula-fd]
• Ferm::Rule[filter_log_filter-bootp]
• Cfssl::Csr[/etc/cfssl/csr/etcd.csr]
• File[/etc/cfssl/ssl/dse_front_proxy/dse_front_proxy-key.pem]
• File[/etc/cfssl/ssl/zuul/zuul.pem]
• File[/etc/rsyslog.d/40-wmf-auto-restart-ulogd2.conf]
• Cfssl::Csr[/etc/cfssl/csr/wikikube.csr]
• Cfssl::Cert[cassandra]
• Cfssl::Csr[/etc/cfssl/csr/mlserve_staging_front_proxy.csr]
• Puppet::Expose_agent_certs[/etc/bacula]
• Exec[Generate cert syslog refresh]
• Exec[Generate cert zuul refresh]
• Exec[renew certificate - network_devices]
• Exec[Generate cert dse refresh]
• File[/etc/ferm/ferm.conf]
• File[/etc/logrotate.d/wmf_auto_restart_ulogd2]
• File[/etc/cfssl/ssl/wikikube_staging_front_proxy/wikikube_staging_front_proxy.csr]
• File[/etc/cfssl/ssl/etcd/etcd.pem]
• File[/etc/cfssl/csr/dse_front_proxy.csr]
• Concat::Fragment[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia]
• File[/etc/cfssl/ssl/aux]
• File[/etc/cfssl/ssl/wikikube/wikikube.csr]
• Nrpe::Monitor_service[ferm_active]
• Cfssl::Cert[debmonitor]
• Exec[renew certificate - dse_front_proxy]
• File[/etc/cfssl/signers/Wikimedia_Internal_Root_CA]
• Ferm::Service[full_monitoring_metrics_access_tcp]
• Exec[Generate cert etcd]
• File[/etc/cfssl/ssl/etcd]
• Exec[Generate cert dse_front_proxy refresh]
• Exec[renew certificate - cassandra]
• File[/etc/rsyslog.d/25-nrpe2nodexp-ferm-active.conf]
• Systemd::Syslog[wmf_auto_restart_ulogd2]
• File[/etc/cfssl/csr/etcd.csr]
• File[/etc/cfssl/ssl/debmonitor/debmonitor.csr]
• Exec[create-/etc/bacula-keypair]
• File[/etc/cfssl/ssl/debmonitor/debmonitor.pem]
• File[/etc/cfssl/ssl/puppet/puppet.csr]
• Exec[renew certificate - dse]
• File[/etc/cfssl/ssl/zuul]
• Cfssl::Cert[aux]
• Exec[Generate cert mlserve_staging refresh]
• Concat::Fragment[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia-header]
• File[/lib/systemd/system/nrpe2nodexp-ferm_active.timer]
• Ferm::Service[ssh_from_cumin_masters]
• File[/etc/ferm/conf.d/10_bacula_file_daemon_backup1014_eqiad_wmnet]
• Logrotate::Conf[ulogd]
• Cfssl::Csr[/etc/cfssl/csr/syslog.csr]
• Exec[renew certificate - zuul]
• Sudo::User[nrpe-check_ferm_active]
• File[/etc/cfssl/csr/dse.csr]
• Cfssl::Cert[mlserve_staging_front_proxy]
• Cfssl::Cert[network_devices]
• Exec[Generate cert discovery2026 refresh]
• File[/etc/ferm/functions.conf]
• File[/etc/cfssl/ssl/mlserve_staging_front_proxy/mlserve_staging_front_proxy.csr]
• File[/etc/ferm/conf.d/10_full_monitoring_metrics_access_tcp]
• Ferm::Filter_log[filter-bootp]
• Exec[systemd daemon-reload for wmf_auto_restart_ulogd2.service (wmf_auto_restart_ulogd2.service)]
• Concat::Fragment[/etc/bacula_puppet_ca_chain]
• Systemd::Unit[wmf_auto_restart_ulogd2.service]
• Class[Ulogd]
• Exec[Generate cert kafka]
• Sslcert::X509_to_pkcs12[puppet::expose_agent_cert: /etc/bacula]
• File[/etc/cfssl/ssl/Wikimedia_Internal_Root_CA_ocsp_signing_cert/Wikimedia_Internal_Root_CA_ocsp_signing_cert.pem]
• Cfssl::Cert[wikikube_staging_front_proxy]
• Monitoring::Exported_nagios_service[pki-root1002 ferm_active]
• Exec[renew certificate - aux_front_proxy]
• File[/etc/cfssl/csr/Wikimedia_Internal_Root_CA.csr]
• File[/etc/cfssl/ssl/aux_front_proxy]
• Rsyslog::Conf[ulogd]
• Service[ferm]
• File[/etc/cfssl/csr/cloud_wmnet_ca.csr]
• File[/etc/ulogd.conf]
• Cfssl::Csr[/etc/cfssl/csr/wikikube_staging_front_proxy.csr]
• File[/etc/cfssl/ssl/aux/aux.pem]
• Bacula::Client::Job[pki-root-cfssl-Monthly-1st-Wed-productionEqiad]
• File[/etc/cfssl/csr/debmonitor.csr]
• Firewall::Service[bacula-file-daemon-backup1014.eqiad.wmnet]
• Service[nrpe2nodexp-ferm_active.timer]
• Exec[renew certificate - wikikube_front_proxy]
• File[/etc/cfssl/ssl/wikikube/wikikube.pem]
• Cfssl::Csr[/etc/cfssl/csr/puppet_rsa.csr]
• Apt::Repository[component-bacula9-apt.wikimedia.org-wikimedia-trixie-wikimedia]
• File[/etc/bacula/ssl/server.p12]
• Exec[Generate cert debmonitor]
• File[/etc/bacula/ssl/server-keypair.pem]
• File[/lib/systemd/system/nrpe2nodexp-ferm_active.service]
• Nrpe::Plugin[check_ferm]
• Cfssl::Cert[zuul]
• Nrpe::Check[check_ferm_active]
• File[/etc/cfssl/ssl/aux/aux.csr]
• Cfssl::Cert[syslog]
• Ferm::Service[full_monitoring_metrics_access_udp]
• Cfssl::Cert[mlserve_staging]
• File[/etc/cfssl/csr/aux_front_proxy.csr]
• File[/etc/cfssl/ssl/mlserve_staging]
• File[/etc/ferm/conf.d/01_drop-blocked-nets]
• File[/etc/cfssl/ssl/mlserve_front_proxy/mlserve_front_proxy-key.pem]
• File[/etc/systemd/system/ferm.service.d]
• File[/etc/cfssl/ssl/mlserve_front_proxy/mlserve_front_proxy.pem]
• File[/lib/systemd/system/wmf_auto_restart_ulogd2.service]
• File[/etc/cfssl/ssl/zuul/zuul-key.pem]
• File[/etc/cfssl/ssl/cassandra]
• Class[Profile::Firewall::Log::Ferm]
• Exec[Generate cert puppet refresh]
• Exec[Generate cert kafka refresh]
• Cfssl::Cert[mlserve]
• Motd::Message[pki::root]
• File[/etc/cfssl/ssl/puppet/puppet-key.pem]
• File[/etc/cfssl/ssl/network_devices]
• File[/etc/cfssl/csr/network_devices.csr]
• File[/etc/update-motd.d/05-pki--root]
• Ferm::Rule[dscp-default]
• Exec[Generate cert syslog]
• File[/etc/cfssl/csr/kafka.csr]
• Exec[Generate cert aux_front_proxy refresh]
• File[/etc/cfssl/ssl/wikikube_front_proxy]
• Exec[systemd daemon-reload for ferm.service (ferm-ferm-service-status-restart)]
• File[/etc/update-motd.d/06-backups-pki-root-cfssl]
• File[/etc/cfssl/csr/wikikube.csr]
• File[/usr/local/lib/nagios/plugins/check_ferm]
• Exec[Generate cert mlserve_staging_front_proxy refresh]
• Cfssl::Csr[/etc/cfssl/csr/kafka.csr]
• File[/etc/cfssl/csr/mlserve_staging.csr]
• Exec[Generate cert wikikube_staging]
• File[/etc/cfssl/ssl/dse/dse-key.pem]
• Exec[renew certificate - mlserve_front_proxy]
• File[/etc/cfssl/csr/zuul.csr]
• File[/etc/cfssl/ssl/wikikube/wikikube-key.pem]
• Cfssl::Cert[kafka]
• Exec[renew certificate - mlserve_staging_front_proxy]
• File[/etc/cfssl/ssl/mlserve_staging/mlserve_staging.csr]
• Cfssl::Csr[/etc/cfssl/csr/zuul.csr]

Resources only in the old catalog

• File[/etc/nftables/sets/MGMT_NETWORKS_ipv4.nft]
• File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv4.nft]
• File[/etc/nftables/sets/FRACK_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/CLOUD_NETWORKS_ipv6.nft]
• Systemd::Service[nftables]
• File[/var/log/prometheus-node-textfile-check-nft]
• File[/etc/nftables/prerouting]
• File[/etc/nftables/sets/LABS_NETWORKS_ipv6.nft]
• Nftables::File[base]
• Nftables::Set[KAFKA_BROKERS_LOGGING]
• File[/etc/nftables/sets/LABSTORE_HOSTS_ipv6.nft]
• File[/etc/nftables/forward]
• File[/etc/nftables/sets/NETWORK_INFRA_ipv6.nft]
• File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv6.nft]
• Rsyslog::Conf[prometheus-node-textfile-check-nft]
• File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv6.nft]
• File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv6.nft]
• Nftables::Set[DEPLOYMENT_HOSTS]
• File[/etc/nftables/sets]
• File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/MGMT_NETWORKS_ipv6.nft]
• Nftables::Set[KAFKAMON_HOSTS]
• File[/etc/nftables/sets/BASTION_HOSTS_ipv4.nft]
• File[/usr/local/bin/check-nft]
• File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv6.nft]
• File[/etc/nftables/postrouting]
• File[/etc/nftables/input/10_ssh-from-bastion.nft]
• File[/etc/logrotate.d/prometheus-node-textfile-check-nft]
• Nftables::Set[MLSERVE_KUBEPODS_NETWORKS]
• File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv4.nft]
• Nftables::Set[DRUID_PUBLIC_HOSTS]
• Class[Role::Insetup::Infrastructure_foundations_nftables]
• File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv4.nft]
• File[/etc/nftables/sets/NETWORK_INFRA_ipv4.nft]
• File[/etc/nftables/sets/DRUID_PUBLIC_HOSTS_ipv6.nft]
• File[/etc/nftables/sets/DSE_KUBEPODS_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/MW_APPSERVER_NETWORKS_ipv4.nft]
• Systemd::Unmask[nftables.service]
• Nftables::Set[LINK_LOCAL]
• Nftables::Service[ssh-from-cumin-masters]
• File[/etc/nftables/input/10_full-monitoring-metrics-access-tcp.nft]
• File[/etc/nftables.conf]
• File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv4.nft]
• Systemd::Service[prometheus-node-textfile-check-nft]
• File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv4.nft]
• File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv4.nft]
• File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv4.nft]
• File[/etc/nftables/sets/CACHES_ipv4.nft]
• File[/etc/nftables/sets/PROMETHEUS_HOSTS_ipv4.nft]
• File[/etc/systemd/system/nftables.service.d]
• Nftables::Set[MONITORING_HOSTS]
• File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv4.nft]
• Motd::Script[insetup::infrastructure_foundations_nftables]
• Service[nftables]
• File[/etc/nftables/sets/LINK_LOCAL_ipv4.nft]
• Nftables::Set[KAFKA_BROKERS_MAIN]
• Service[prometheus-node-textfile-check-nft.timer]
• File[/etc/nftables/sets/CUMIN_MASTERS_ipv4.nft]
• File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv6.nft]
• Nftables::Service[full-monitoring-metrics-access-udp]
• File[/etc/nftables/notrack]
• Class[Profile::Firewall::Nftables_base_sets]
• Systemd::Unit[prometheus-node-textfile-check-nft.service]
• Nftables::Set[LOAD_BALANCER_HEALTH_CHECKS]
• File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv6.nft]
• Systemd::Syslog[prometheus-node-textfile-check-nft]
• File[/etc/nftables/sets/CACHES_ipv6.nft]
• Logrotate::Conf[prometheus-node-textfile-check-nft]
• Nftables::Set[MLSTAGE_KUBEPODS_NETWORKS]
• Nftables::Set[LABS_NETWORKS]
• File[/etc/nftables/sets/LABSTORE_HOSTS_ipv4.nft]
• File[/etc/nftables/sets/MONITORING_HOSTS_ipv4.nft]
• File[/etc/nftables/sets/DEPLOYMENT_HOSTS_ipv6.nft]
• File[/etc/nftables/sets/CUMIN_MASTERS_ipv6.nft]
• File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv4.nft]
• File[/lib/systemd/system/prometheus-node-textfile-check-nft.service]
• Nftables::Set[SANDBOX_NETWORKS]
• File[/etc/nftables/sets/KAFKA_BROKERS_JUMBO_ipv4.nft]
• File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv4.nft]
• File[/etc/nftables/sets/PRODUCTION_NETWORKS_ipv4.nft]
• Nftables::Set[CUMIN_MASTERS]
• Nftables::Service[full-monitoring-metrics-access-tcp]
• Nftables::Set[PROMETHEUS_HOSTS]
• Nftables::Set[INTERNAL]
• Systemd::Unit[prometheus-node-textfile-check-nft.timer]
• File[/etc/nftables/sets/LOAD_BALANCER_HEALTH_CHECKS_ipv6.nft]
• File[/etc/nftables/main.nft]
• Nftables::Set[CLOUD_NETWORKS_PUBLIC]
• File[/etc/nftables/sets/CLOUD_NETWORKS_PUBLIC_ipv6.nft]
• Nftables::Set[ZOOKEEPER_HOSTS_MAIN]
• File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv4.nft]
• Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.timer (prometheus-node-textfile-check-nft.timer)]
• Nftables::Service[ssh-from-bastion]
• Nftables::Set[BASTION_HOSTS]
• File[/etc/nftables/sets/MLSERVE_KUBEPODS_NETWORKS_ipv4.nft]
• Nftables::Set[WIKIKUBE_KUBEPODS_NETWORKS]
• Exec[unmask_nftables.service]
• Nftables::Set[DOMAIN_NETWORKS]
• File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv4.nft]
• Nftables::Set[STAGING_KUBEPODS_NETWORKS]
• Nftables::Set[KAFKA_BROKERS_JUMBO]
• File[/etc/nftables/sets/INSTALL_HOSTS_ipv6.nft]
• File[/etc/nftables/sets/MONITORING_HOSTS_ipv6.nft]
• File[/etc/nftables/sets/LABS_NETWORKS_ipv4.nft]
• File[/etc/nftables/sets/MYSQL_ROOT_CLIENTS_ipv4.nft]
• File[/etc/nftables/100_base_puppet.nft]
• Nftables::Set[ZOOKEEPER_FLINK_HOSTS]
• Nftables::Set[CACHES]
• File[/etc/nftables/input/10_ssh-from-cumin-masters.nft]
• File[/lib/systemd/system/prometheus-node-textfile-check-nft.timer]
• Class[Nftables]
• File[/etc/nftables/input]
• File[/etc/nftables/sets/LINK_LOCAL_ipv6.nft]
• File[/etc/nftables/sets/STAGING_KUBEPODS_NETWORKS_ipv6.nft]
• Systemd::Unit[nftables]
• File[/etc/nftables/sets/FRACK_NETWORKS_ipv4.nft]
• Nftables::Set[NETWORK_INFRA]
• Nftables::Set[PRODUCTION_NETWORKS]
• File[/etc/rsyslog.d/40-prometheus-node-textfile-check-nft.conf]
• File[/etc/nftables/sets/WIKIKUBE_KUBEPODS_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv4.nft]
• File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv6.nft]
• Nftables::Set[CLOUD_PRIVATE_NETWORKS]
• Motd::Message[insetup::infrastructure_foundations_nftables]
• File[/etc/nftables/sets/ZOOKEEPER_HOSTS_MAIN_ipv6.nft]
• File[/etc/nftables/sets/ANALYTICS_NETWORKS_ipv6.nft]
• File[/etc/nftables/]
• Prometheus::Node_textfile[check-nft]
• File[/etc/nftables/sets/SANDBOX_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/INTERNAL_ipv6.nft]
• File[/etc/nftables/output]
• File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv4.nft]
• File[/etc/nftables/input/10_full-monitoring-metrics-access-udp.nft]
• Nftables::Set[AUX_KUBEPODS_NETWORKS]
• File[/etc/nftables/sets/CLOUD_PRIVATE_NETWORKS_ipv6.nft]
• File[/etc/nftables/sets/INTERNAL_ipv4.nft]
• Nftables::Set[FRACK_NETWORKS]
• File[/etc/update-motd.d/05-insetup--infrastructure-foundations-nftables]
• Systemd::Timer[prometheus-node-textfile-check-nft]
• File[/etc/nftables/sets/CLOUD_NETWORKS_ipv4.nft]
• Systemd::Timer::Job[prometheus-node-textfile-check-nft]
• Nftables::Set[MW_APPSERVER_NETWORKS]
• Exec[systemd daemon-reload for nftables.service (nftables)]
• File[/etc/nftables/sets/KAFKA_BROKERS_LOGGING_ipv4.nft]
• File[/etc/nftables/sets/INSTALL_HOSTS_ipv4.nft]
• File[/etc/nftables/sets/DOMAIN_NETWORKS_ipv4.nft]
• Nftables::Set[INSTALL_HOSTS]
• File[/etc/systemd/system/nftables.service.d/puppet-override.conf]
• File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv4.nft]
• Nftables::Set[MYSQL_ROOT_CLIENTS]
• Exec[systemd daemon-reload for prometheus-node-textfile-check-nft.service (prometheus-node-textfile-check-nft.service)]
• Nftables::Set[DSE_KUBEPODS_NETWORKS]
• Nftables::Set[LABSTORE_HOSTS]
• File[/etc/nftables/sets/KAFKAMON_HOSTS_ipv6.nft]
• Node[__node_regexp__pki-root1002.eqiad.]
• File[/etc/nftables/sets/MLSTAGE_KUBEPODS_NETWORKS_ipv6.nft]
• Package[nftables]
• File[/etc/nftables/sets/ZOOKEEPER_FLINK_HOSTS_ipv6.nft]
• File[/etc/nftables/sets/KAFKA_BROKERS_MAIN_ipv4.nft]
• File[/etc/nftables/sets/AUX_KUBEPODS_NETWORKS_ipv6.nft]
• Nftables::Set[CLOUD_NETWORKS]
• Nftables::Set[MGMT_NETWORKS]
• Nftables::Set[ANALYTICS_NETWORKS]
• File[/etc/nftables/sets/BASTION_HOSTS_ipv6.nft]

Resources modified

• Class[Profile::Cumin::Target]

  Parameters differences:

  --- Class[Profile::Cumin::Target].orig
  +++ Class[Profile::Cumin::Target]
  
  @@
  -    cluster => insetup
  +    cluster => pki
  

• Class[Monitoring]

  Parameters differences:

  --- Class[Monitoring].orig
  +++ Class[Monitoring]
  
  @@
  -    nagios_group          => insetup_eqiad
  +    nagios_group          => pki_eqiad
  @@
  -    cluster               => insetup
  +    cluster               => pki
  @@
  -    notifications_enabled => False
  +    notifications_enabled => True
  

• Class[Profile::Contacts]

  Parameters differences:

  --- Class[Profile::Contacts].orig
  +++ Class[Profile::Contacts]
  
  @@
  -    cluster => insetup
  +    cluster => pki
  

• File[/etc/confd/templates/_etc_ferm_conf.d_00_defs_requestctl.tmpl]

  Parameters differences:

  --- File[/etc/confd/templates/_etc_ferm_conf.d_00_defs_requestctl.tmpl].orig
  +++ File[/etc/confd/templates/_etc_ferm_conf.d_00_defs_requestctl.tmpl]
  
  @@
  -    ensure => absent
  +    ensure => present
  

• Class[Profile::Base]

  Parameters differences:

  --- Class[Profile::Base].orig
  +++ Class[Profile::Base]
  
  @@
  -    cluster => insetup
  +    cluster => pki
  

• Class[Cumin::Selector]

  Parameters differences:

  --- Class[Cumin::Selector].orig
  +++ Class[Cumin::Selector]
  
  @@
  -    cluster => insetup
  +    cluster => pki
  

• Package[iptables]

  Parameters differences:

  --- Package[iptables].orig
  +++ Package[iptables]
  
  @@
  -    ensure => absent
  +    ensure => installed
  

• Monitoring::Exported_nagios_service[pki-root1002 raid_md]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki-root1002 raid_md].orig
  +++ Monitoring::Exported_nagios_service[pki-root1002 raid_md]
  
  @@
  -    servicegroups         => insetup_eqiad
  +    servicegroups         => pki_eqiad
  @@
  -    notifications_enabled => 0
  +    notifications_enabled => 1
  

• File[/usr/local/sbin/ferm-status]

  Parameters differences:

  --- File[/usr/local/sbin/ferm-status].orig
  +++ File[/usr/local/sbin/ferm-status]
  
  @@
  -    ensure => absent
  +    ensure => file
  

• File[/etc/confd/conf.d/_etc_ferm_conf.d_00_defs_requestctl.toml]

  Parameters differences:

  --- File[/etc/confd/conf.d/_etc_ferm_conf.d_00_defs_requestctl.toml].orig
  +++ File[/etc/confd/conf.d/_etc_ferm_conf.d_00_defs_requestctl.toml]
  
  @@
  -    ensure => absent
  +    ensure => present
  

• Monitoring::Exported_nagios_service[pki-root1002 ssh]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki-root1002 ssh].orig
  +++ Monitoring::Exported_nagios_service[pki-root1002 ssh]
  
  @@
  -    servicegroups         => insetup_eqiad
  +    servicegroups         => pki_eqiad
  @@
  -    notifications_enabled => 0
  +    notifications_enabled => 1
  

• Class[Ferm]

  Parameters differences:

  --- Class[Ferm].orig
  +++ Class[Ferm]
  
  @@
  -    ensure => absent
  +    ensure => present
  

• File[/etc/ferm]

  Parameters differences:

  --- File[/etc/ferm].orig
  +++ File[/etc/ferm]
  
  @@
  -    ensure => absent
  +    ensure => directory
  

• Class[Adduser]

  Parameters differences:

  --- Class[Adduser].orig
  +++ Class[Adduser]
  
  @@
  -    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[starship]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[linux-sysctl-defaults]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[perccli]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[ruby-concurrent]', 'Package[ruby]', 'Package[libruby]', 'Package[puppet-agent]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']
  +    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[starship]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[linux-sysctl-defaults]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[perccli]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[ruby-concurrent]', 'Package[ruby]', 'Package[libruby]', 'Package[puppet-agent]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[bacula-fd]', 'Package[bacula-common]']
  

• Class[Profile::Base::Production]

  Parameters differences:

  --- Class[Profile::Base::Production].orig
  +++ Class[Profile::Base::Production]
  
  @@
  -    role_description => Host being setup by Infrastructure Foundations SREs with ntables
  +    role_description => PKI RootCA
  

• File[/etc/ferm/conf.d/00_defs_requestctl]

  Parameters differences:

  --- File[/etc/ferm/conf.d/00_defs_requestctl].orig
  +++ File[/etc/ferm/conf.d/00_defs_requestctl]
  
  @@
  -    ensure => absent
  +    ensure => file
  

• Confd::File[/etc/ferm/conf.d/00_defs_requestctl]

  Parameters differences:

  --- Confd::File[/etc/ferm/conf.d/00_defs_requestctl].orig
  +++ Confd::File[/etc/ferm/conf.d/00_defs_requestctl]
  
  @@
  -    ensure => absent
  +    ensure => present
  

• Monitoring::Exported_nagios_host[pki-root1002]

  Parameters differences:

  --- Monitoring::Exported_nagios_host[pki-root1002].orig
  +++ Monitoring::Exported_nagios_host[pki-root1002]
  
  @@
  -    hostgroups            => insetup_eqiad,asw2-b-eqiad
  +    hostgroups            => pki_eqiad,asw2-b-eqiad
  @@
  -    notifications_enabled => 0
  +    notifications_enabled => 1
  

• Class[Profile::Firewall]

  Parameters differences:

  --- Class[Profile::Firewall].orig
  +++ Class[Profile::Firewall]
  
  @@
  -    provider => nftables
  +    provider => ferm
  

• Class[Profile::Monitoring]

  Parameters differences:

  --- Class[Profile::Monitoring].orig
  +++ Class[Profile::Monitoring]
  
  @@
  -    nagios_group          => insetup_eqiad
  +    nagios_group          => pki_eqiad
  @@
  -    cluster               => insetup
  +    cluster               => pki
  @@
  -    notifications_enabled => False
  +    notifications_enabled => True
  

• File[/etc/modules-load.d/conntrack.conf]

  Parameters differences:

  --- File[/etc/modules-load.d/conntrack.conf].orig
  +++ File[/etc/modules-load.d/conntrack.conf]
  
  @@
  -    ensure => absent
  +    ensure => file
  

• Monitoring::Exported_nagios_service[pki-root1002 disk_space]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki-root1002 disk_space].orig
  +++ Monitoring::Exported_nagios_service[pki-root1002 disk_space]
  
  @@
  -    servicegroups         => insetup_eqiad
  +    servicegroups         => pki_eqiad
  @@
  -    notifications_enabled => 0
  +    notifications_enabled => 1
  

• Concat::Fragment[main contacts]

• Package[ferm]

  Parameters differences:

  --- Package[ferm].orig
  +++ Package[ferm]
  
  @@
  -    ensure => purged
  +    ensure => installed
  

• Concat_fragment[main contacts]

  Content differences:

  --- main contacts.orig
  +++ main contacts
  @@ -1,3 +1,3 @@
   ---
  -role::insetup::infrastructure_foundations_nftables:
  +role::pki::root:
   - Infrastructure Foundations

• File[/var/lib/prometheus/node.d/role_owner.prom]

  Content differences:

  --- /var/lib/prometheus/node.d/role_owner.prom.orig
  +++ /var/lib/prometheus/node.d/role_owner.prom
  @@ -1,3 +1,3 @@
   # HELP role_owner The team owner of the server role
   # TYPE role_owner gauge
  -role_owner{team="infrastructure-foundations",role="insetup::infrastructure_foundations_nftables",cluster="insetup"} 1.0
  +role_owner{team="infrastructure-foundations",role="pki::root",cluster="pki"} 1.0

• Class[Firewall]

  Parameters differences:

  --- Class[Firewall].orig
  +++ Class[Firewall]
  
  @@
  -    provider => nftables
  +    provider => ferm
  

• Monitoring::Exported_nagios_service[pki-root1002 raid_broadcom_raid]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[pki-root1002 raid_broadcom_raid].orig
  +++ Monitoring::Exported_nagios_service[pki-root1002 raid_broadcom_raid]
  
  @@
  -    servicegroups         => insetup_eqiad
  +    servicegroups         => pki_eqiad
  @@
  -    notifications_enabled => 0
  +    notifications_enabled => 1
  

• Class[Profile::Apt]

  Parameters differences:

  --- Class[Profile::Apt].orig
  +++ Class[Profile::Apt]
  
  @@
  -    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[starship]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[linux-sysctl-defaults]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[perccli]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[ruby-concurrent]', 'Package[ruby]', 'Package[libruby]', 'Package[puppet-agent]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']
  +    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[starship]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[linux-sysctl-defaults]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[perccli]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[ruby-concurrent]', 'Package[ruby]', 'Package[libruby]', 'Package[puppet-agent]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[bacula-fd]', 'Package[bacula-common]']
  

Relevant files

• Production catalog
• Change catalog
• Production errors/warnings
• Change errors/warnings
• Core Diff
• Full Diff