Compilation results for deploy1003.eqiad.wmnet: System changes detected

Catalog differences

Summary

Resources only in the new catalog

• File[/etc/kubernetes/pki/dse__wdqs-next-deploy.csr]
• File[/etc/cfssl/csr/dse__wdqs.csr]
• Exec[renew certificate - dse__wdqs-next]
• File[/etc/kubernetes/pki/dse__wdqs.chain.pem]
• File[/etc/kubernetes/pki/dse__wdqs-deploy.csr]
• File[/etc/kubernetes/pki/dse__wdqs.csr]
• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-deploy.chain.pem]
• File[/etc/kubernetes/pki/dse__wdqs-next.chained.pem]
• File[/etc/kubernetes/pki/dse__wdqs.chained.pem]
• File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs]
• Cfssl::Cert[dse__wdqs-next]
• File[/etc/cfssl/csr/dse__wdqs-next.csr]
• File[/etc/kubernetes/wdqs-deploy-dse-k8s-eqiad.config]
• File[/etc/kubernetes/wdqs-next-deploy-dse-k8s-codfw.config]
• Exec[Generate cert dse__wdqs-next]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-dse-k8s-eqiad.config]
• File[/etc/kubernetes/wdqs-deploy-dse-k8s-codfw.config]
• File[/etc/kubernetes/pki/dse__wdqs-deploy-key.pem]
• Exec[Generate cert dse__wdqs-next-deploy refresh]
• Exec[Generate cert dse__wdqs-next-deploy]
• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem]
• File[/etc/kubernetes/pki/dse__wdqs-next.csr]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-next-dse-k8s-codfw.config]
• Cfssl::Cert[dse__wdqs]
• File[/etc/kubernetes/pki/dse__wdqs-deploy.chain.pem]
• File[/etc/kubernetes/pki/dse__wdqs-key.pem]
• Exec[Generate cert dse__wdqs]
• File[/etc/cfssl/csr/dse__wdqs-deploy.csr]
• Exec[Generate cert dse__wdqs refresh on intermediate ca change]
• File[/etc/cfssl/csr/dse__wdqs-next-deploy.csr]
• File[/etc/kubernetes/pki/dse__wdqs-next-deploy.pem]
• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs.csr]
• File[/etc/kubernetes/pki/dse__wdqs-next.pem]
• File[/etc/kubernetes/wdqs-next-dse-k8s-codfw.config]
• File[/etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-deploy-dse-k8s-eqiad.config]
• Exec[Generate cert dse__wdqs-next refresh]
• Exec[Generate cert dse__wdqs-next-deploy refresh on intermediate ca change]
• Exec[Generate cert dse__wdqs-deploy refresh]
• File[/etc/kubernetes/pki/dse__wdqs-next-deploy-key.pem]
• File[/etc/kubernetes/pki/dse__wdqs-next-deploy.chained.pem]
• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs.chain.pem]
• File[/etc/kubernetes/wdqs-next-deploy-dse-k8s-eqiad.config]
• Exec[Generate cert dse__wdqs-next refresh on intermediate ca change]
• Exec[renew certificate - dse__wdqs]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-next-dse-k8s-eqiad.config]
• File[/etc/kubernetes/pki/dse__wdqs-next.chain.pem]
• File[/etc/kubernetes/wdqs-next-dse-k8s-eqiad.config]
• Exec[Generate cert dse__wdqs refresh]
• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-next.chain.pem]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-next-deploy-dse-k8s-eqiad.config]
• Exec[Generate cert dse__wdqs-deploy]
• Exec[renew certificate - dse__wdqs-next-deploy]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-next-deploy-dse-k8s-codfw.config]
• File[/etc/kubernetes/pki/dse__wdqs-next-key.pem]
• Exec[Generate cert dse__wdqs-deploy refresh on intermediate ca change]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-deploy-dse-k8s-codfw.config]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-dse-k8s-codfw.config]
• File[/etc/kubernetes/pki/dse__wdqs.pem]
• File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-next]
• File[/etc/kubernetes/wdqs-dse-k8s-eqiad.config]
• Exec[renew certificate - dse__wdqs-deploy]
• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-deploy.csr]
• File[/etc/kubernetes/pki/dse__wdqs-deploy.pem]
• File[/etc/kubernetes/wdqs-dse-k8s-codfw.config]
• File[/etc/kubernetes/pki/dse__wdqs-deploy.chained.pem]
• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-next.csr]
• Cfssl::Cert[dse__wdqs-next-deploy]
• Cfssl::Cert[dse__wdqs-deploy]
• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-next-deploy.csr]

Resources only in the old catalog

• File[/etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem]
• File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.csr]
• Exec[Generate cert dse__wdqs-internal-next refresh]
• File[/etc/kubernetes/pki/dse__wdqs-internal-key.pem]
• Cfssl::Cert[dse__wdqs-external-next-deploy]
• File[/etc/kubernetes/pki/dse__wdqs-external-next.pem]
• Exec[Generate cert dse__wdqs-external-next refresh on intermediate ca change]
• File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chained.pem]
• File[/etc/kubernetes/pki/dse__wdqs-external-next.chain.pem]
• Exec[renew certificate - dse__wdqs-external-next-deploy]
• File[/etc/kubernetes/pki/dse__wdqs-external-next.chained.pem]
• File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.pem]
• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external.chain.pem]
• File[/etc/kubernetes/wdqs-external-deploy-dse-k8s-codfw.config]
• Exec[renew certificate - dse__wdqs-internal-next-deploy]
• Exec[Generate cert dse__wdqs-internal-deploy refresh]
• Exec[renew certificate - dse__wdqs-internal]
• File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-internal]
• File[/etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem]
• Exec[Generate cert dse__wdqs-internal-next]
• Exec[Generate cert dse__wdqs-external refresh]
• Exec[Generate cert dse__wdqs-external-next-deploy refresh]
• File[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-eqiad.config]
• Cfssl::Cert[dse__wdqs-external]
• File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-external-next]
• File[/etc/cfssl/csr/dse__wdqs-internal.csr]
• Exec[Generate cert dse__wdqs-internal-next-deploy]
• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem]
• Exec[Generate cert dse__wdqs-internal refresh on intermediate ca change]
• File[/etc/cfssl/csr/dse__wdqs-internal-deploy.csr]
• Exec[Generate cert dse__wdqs-external]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-eqiad.config]
• File[/etc/kubernetes/pki/dse__wdqs-external.csr]
• File[/etc/kubernetes/pki/dse__wdqs-internal.pem]
• Exec[Generate cert dse__wdqs-external-next-deploy]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-dse-k8s-eqiad.config]
• Exec[renew certificate - dse__wdqs-external-deploy]
• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-next.chain.pem]
• Exec[Generate cert dse__wdqs-external-deploy]
• File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-internal-next]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-codfw.config]
• Exec[renew certificate - dse__wdqs-external]
• File[/etc/kubernetes/pki/dse__wdqs-external-deploy-key.pem]
• File[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-eqiad.config]
• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr]
• File[/etc/kubernetes/pki/dse__wdqs-external.chain.pem]
• File[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-codfw.config]
• File[/etc/kubernetes/pki/dse__wdqs-external-next-key.pem]
• File[/etc/kubernetes/pki/dse__wdqs-external-key.pem]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-deploy-dse-k8s-eqiad.config]
• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-deploy.csr]
• File[/etc/kubernetes/pki/dse__wdqs-external-deploy.pem]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-codfw.config]
• File[/etc/kubernetes/wdqs-external-next-dse-k8s-eqiad.config]
• Exec[renew certificate - dse__wdqs-internal-deploy]
• File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.pem]
• Exec[Generate cert dse__wdqs-external refresh on intermediate ca change]
• File[/etc/cfssl/csr/dse__wdqs-external-deploy.csr]
• File[/etc/kubernetes/wdqs-external-next-dse-k8s-codfw.config]
• File[/etc/kubernetes/wdqs-internal-next-dse-k8s-codfw.config]
• File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.csr]
• File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chained.pem]
• File[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-eqiad.config]
• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal.chain.pem]
• Exec[renew certificate - dse__wdqs-external-next]
• Exec[renew certificate - dse__wdqs-internal-next]
• File[/etc/kubernetes/pki/dse__wdqs-internal.chained.pem]
• Cfssl::Cert[dse__wdqs-internal-next-deploy]
• File[/etc/kubernetes/wdqs-internal-dse-k8s-codfw.config]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-eqiad.config]
• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-next-deploy.csr]
• Cfssl::Cert[dse__wdqs-external-deploy]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-dse-k8s-eqiad.config]
• Exec[Generate cert dse__wdqs-external-next]
• File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy-key.pem]
• File[/etc/kubernetes/pki/dse__wdqs-internal-next.csr]
• File[/etc/kubernetes/pki/dse__wdqs-internal.csr]
• File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem]
• File[/etc/cfssl/csr/dse__wdqs-internal-next.csr]
• File[/etc/kubernetes/pki/dse__wdqs-internal-deploy-key.pem]
• Exec[Generate cert dse__wdqs-external-next refresh]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-dse-k8s-eqiad.config]
• Cfssl::Cert[dse__wdqs-internal]
• File[/etc/kubernetes/wdqs-external-deploy-dse-k8s-eqiad.config]
• File[/etc/kubernetes/pki/dse__wdqs-external-deploy.chained.pem]
• Cfssl::Cert[dse__wdqs-external-next]
• File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.chained.pem]
• File[/etc/kubernetes/wdqs-internal-dse-k8s-eqiad.config]
• File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.pem]
• Exec[Generate cert dse__wdqs-internal-deploy refresh on intermediate ca change]
• Exec[Generate cert dse__wdqs-external-deploy refresh]
• File[/etc/cfssl/csr/dse__wdqs-external.csr]
• File[/etc/kubernetes/wdqs-external-dse-k8s-eqiad.config]
• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem]
• Exec[Generate cert dse__wdqs-internal-next-deploy refresh on intermediate ca change]
• File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem]
• File[/etc/cfssl/csr/dse__wdqs-external-next.csr]
• File[/etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr]
• File[/etc/kubernetes/wdqs-external-dse-k8s-codfw.config]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-dse-k8s-codfw.config]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-dse-k8s-eqiad.config]
• Cfssl::Cert[dse__wdqs-internal-next]
• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal.csr]
• File[/etc/cfssl/csr/dse__wdqs-external-next-deploy.csr]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-deploy-dse-k8s-codfw.config]
• Exec[Generate cert dse__wdqs-internal-deploy]
• File[/etc/kubernetes/pki/dse__wdqs-external-deploy.csr]
• File[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-codfw.config]
• File[/etc/kubernetes/pki/dse__wdqs-internal.chain.pem]
• Exec[Generate cert dse__wdqs-internal refresh]
• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-dse-k8s-codfw.config]
• Exec[Generate cert dse__wdqs-external-deploy refresh on intermediate ca change]
• File[/etc/kubernetes/pki/dse__wdqs-internal-next.pem]
• File[/etc/kubernetes/pki/dse__wdqs-external-next.csr]
• Exec[Generate cert dse__wdqs-external-next-deploy refresh on intermediate ca change]
• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-next.csr]
• Exec[Generate cert dse__wdqs-internal-next refresh on intermediate ca change]
• File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-eqiad.config]
• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-next.csr]
• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-deploy.csr]
• File[/etc/kubernetes/pki/dse__wdqs-external.pem]
• File[/etc/kubernetes/pki/dse__wdqs-external.chained.pem]
• File[/etc/kubernetes/wdqs-internal-next-dse-k8s-eqiad.config]
• File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.csr]
• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external.csr]
• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-dse-k8s-codfw.config]
• Cfssl::Cert[dse__wdqs-internal-deploy]
• File[/etc/kubernetes/pki/dse__wdqs-internal-next-key.pem]
• File[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-codfw.config]
• Exec[Generate cert dse__wdqs-internal-next-deploy refresh]
• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem]
• Exec[Generate cert dse__wdqs-internal]
• File[/etc/kubernetes/pki/dse__wdqs-internal-next.chained.pem]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-dse-k8s-codfw.config]
• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-codfw.config]
• File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy-key.pem]
• File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-external]

Resources modified

• File[/etc/helmfile-defaults/services-dse-k8s-codfw.yaml]

  Content differences:

  --- /etc/helmfile-defaults/services-dse-k8s-codfw.yaml.orig
  +++ /etc/helmfile-defaults/services-dse-k8s-codfw.yaml
  @@ -76,22 +76,14 @@
       usernames:
       - name: opensearch-ttmserver-test
       - name: opensearch-ttmserver-test-deploy
  -  wdqs-internal:
  +  wdqs:
       usernames:
  -    - name: wdqs-internal
  -    - name: wdqs-internal-deploy
  -  wdqs-internal-next:
  +    - name: wdqs
  +    - name: wdqs-deploy
  +  wdqs-next:
       usernames:
  -    - name: wdqs-internal-next
  -    - name: wdqs-internal-next-deploy
  -  wdqs-external:
  -    usernames:
  -    - name: wdqs-external
  -    - name: wdqs-external-deploy
  -  wdqs-external-next:
  -    usernames:
  -    - name: wdqs-external-next
  -    - name: wdqs-external-next-deploy
  +    - name: wdqs-next
  +    - name: wdqs-next-deploy
     echoserver:
       usernames:
       - name: echoserver

• Exec[Generate cert dse__wdqs-deploy refresh]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-deploy refresh].orig
  +++ Exec[Generate cert dse__wdqs-deploy refresh]
  
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-deploy
  
  +    refreshonly => True
  +    subscribe   => File[/etc/cfssl/csr/dse__wdqs-deploy.csr]
  +    environment => ['GODEBUG=x509ignoreCN=0']
  

• Exec[Generate cert dse__wdqs-internal-next refresh]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-internal-next refresh].orig
  +++ Exec[Generate cert dse__wdqs-internal-next refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-internal-next.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal-next
  
  -    refreshonly => True
  -    subscribe   => File[/etc/cfssl/csr/dse__wdqs-internal-next.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/kubernetes/wdqs-external-dse-k8s-codfw.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-external-dse-k8s-codfw.config].orig
  +++ File[/etc/kubernetes/wdqs-external-dse-k8s-codfw.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-external-dse-k8s-codfw.config.orig
  +++ /etc/kubernetes/wdqs-external-dse-k8s-codfw.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-external
  -    namespace: wdqs-external
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
  -users:
  -- name: wdqs-external
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-external.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-external-key.pem

• File[/etc/kubernetes/pki/dse__wdqs-external-next.chained.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-next.chained.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-next.chained.pem]
  
  -    owner   => mwdeploy
  -    require => Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-next.chain.pem]
  -    group   => deployment
  -    ensure  => file
  

• Exec[Generate cert dse__wdqs-next-deploy refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-next-deploy refresh on intermediate ca change].orig
  +++ Exec[Generate cert dse__wdqs-next-deploy refresh on intermediate ca change]
  
  +    refreshonly => True
  +    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-next-deploy.csr]
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-next-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-next-deploy
  
  +    subscribe   => File[/etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem]
  

• Cfssl::Cert[dse__wdqs-internal-next-deploy]

  Parameters differences:

  --- Cfssl::Cert[dse__wdqs-internal-next-deploy].orig
  +++ Cfssl::Cert[dse__wdqs-internal-next-deploy]
  
  -    notify_services => []
  -    renew_seconds   => 952200
  -    names           => [{'organisation': 'view'}, {'organisation': 'deploy'}]
  -    key             => {'algo': 'ecdsa', 'size': 256}
  -    auto_renew      => True
  -    owner           => mwdeploy
  -    provide_chain   => True
  -    mode            => 0740
  -    common_name     => wdqs-internal-next-deploy
  -    label           => dse
  -    ensure          => present
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    group           => deployment
  -    outdir          => /etc/kubernetes/pki
  -    before_services => []
  -    hosts           => []
  

• Exec[renew certificate - dse__wdqs-external-next-deploy]

  Parameters differences:

  --- Exec[renew certificate - dse__wdqs-external-next-deploy].orig
  +++ Exec[renew certificate - dse__wdqs-external-next-deploy]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__wdqs-external-next-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external-next-deploy
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-external-next-deploy.pem -checkend 952200
  -    require     => Exec[Generate cert dse__wdqs-external-next-deploy]
  

• File[/etc/kubernetes/pki/dse__wdqs-external-deploy-key.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-deploy-key.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-deploy-key.pem]
  
  -    show_diff => False
  -    owner     => mwdeploy
  -    mode      => 0440
  -    backup    => False
  -    group     => deployment
  -    ensure    => file
  

• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external.chain.pem].orig
  +++ Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external.chain.pem]
  
  -    command   => /bin/cat /etc/kubernetes/pki/dse__wdqs-external.pem /etc/kubernetes/pki/dse__wdqs-external.chain.pem > /etc/kubernetes/pki/dse__wdqs-external.chained.pem
  -    subscribe => ['Exec[renew certificate - dse__wdqs-external]', 'File[/etc/kubernetes/pki/dse__wdqs-external.chain.pem]', 'File[/etc/kubernetes/pki/dse__wdqs-external.pem]']
  -    require   => Exec[Generate cert dse__wdqs-external refresh on intermediate ca change]
  -    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-external.pem /etc/kubernetes/pki/dse__wdqs-external.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-external.chained.pem | sha512sum)"
  
  

• Exec[renew certificate - dse__wdqs]

  Parameters differences:

  --- Exec[renew certificate - dse__wdqs].orig
  +++ Exec[renew certificate - dse__wdqs]
  
  +    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__wdqs.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs
  
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs.pem -checkend 952200
  +    require     => Exec[Generate cert dse__wdqs]
  

• Exec[Generate cert dse__wdqs-internal-next-deploy refresh]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-internal-next-deploy refresh].orig
  +++ Exec[Generate cert dse__wdqs-internal-next-deploy refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal-next-deploy
  
  -    refreshonly => True
  -    subscribe   => File[/etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/cfssl/csr/dse__wdqs-next.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/dse__wdqs-next.csr].orig
  +++ File[/etc/cfssl/csr/dse__wdqs-next.csr]
  
  +    mode   => 0400
  +    owner  => root
  +    group  => root
  +    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/dse__wdqs-next.csr.orig
  +++ /etc/cfssl/csr/dse__wdqs-next.csr
  @@ -0,0 +1,19 @@
  +{
  +  "CN": "wdqs-next",
  +  "hosts": [
  +    "wdqs-next"
  +  ],
  +  "key": {
  +    "algo": "ecdsa",
  +    "size": 256
  +  },
  +  "names": [
  +    {
  +      "C": null,
  +      "L": null,
  +      "O": "view",
  +      "OU": null,
  +      "S": null
  +    }
  +  ]
  +}

• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-codfw.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-codfw.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-codfw.config]
  
  -    master_host => dse-k8s-ctrl.svc.codfw.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-external-next
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-external-next-deploy
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-external-next-deploy.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-external-next-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chained.pem'}
  -    group       => deployment
  

• File[/etc/kubernetes/pki/dse__wdqs-external-next.csr]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-next.csr].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-next.csr]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• Exec[Generate cert dse__wdqs]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs].orig
  +++ Exec[Generate cert dse__wdqs]
  
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs
  
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__wdqs-key.pem 2>&1)"
  
  +    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs.csr]
  

• File[/etc/kubernetes/pki/dse__wdqs-internal.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal.pem]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem]
  
  -    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
  -    owner  => mwdeploy
  -    mode   => 0440
  -    group  => deployment
  -    ensure => file
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-dse-k8s-codfw.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-dse-k8s-codfw.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-dse-k8s-codfw.config]
  
  -    master_host => dse-k8s-ctrl.svc.codfw.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-internal
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-internal
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-internal.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-internal-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-internal.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-internal.chained.pem'}
  -    group       => deployment
  

• File[/etc/kubernetes/wdqs-next-deploy-dse-k8s-eqiad.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-next-deploy-dse-k8s-eqiad.config].orig
  +++ File[/etc/kubernetes/wdqs-next-deploy-dse-k8s-eqiad.config]
  
  +    mode   => 0640
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-next-deploy-dse-k8s-eqiad.config.orig
  +++ /etc/kubernetes/wdqs-next-deploy-dse-k8s-eqiad.config
  @@ -0,0 +1,19 @@
  +apiVersion: v1
  +kind: Config
  +preferences: {}
  +current-context: default-system
  +contexts:
  +- name: default-system
  +  context:
  +    cluster: default-cluster
  +    user: wdqs-next-deploy
  +    namespace: wdqs-next
  +clusters:
  +- name: default-cluster
  +  cluster:
  +    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
  +users:
  +- name: wdqs-next-deploy
  +  user:
  +    client-certificate: /etc/kubernetes/pki/dse__wdqs-next-deploy.pem
  +    client-key: /etc/kubernetes/pki/dse__wdqs-next-deploy-key.pem

• Exec[Generate cert dse__wdqs-external-next]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-external-next].orig
  +++ Exec[Generate cert dse__wdqs-external-next]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-external-next.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external-next
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-external-next.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__wdqs-external-next-key.pem 2>&1)"
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-next.csr]
  

• File[/etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem]
  
  +    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
  +    owner  => mwdeploy
  +    mode   => 0440
  +    group  => deployment
  +    ensure => file
  

• Exec[renew certificate - dse__wdqs-external-next]

  Parameters differences:

  --- Exec[renew certificate - dse__wdqs-external-next].orig
  +++ Exec[renew certificate - dse__wdqs-external-next]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__wdqs-external-next.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external-next
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-external-next.pem -checkend 952200
  -    require     => Exec[Generate cert dse__wdqs-external-next]
  

• File[/etc/profile.d/kube-conf.sh]

  Content differences:

  --- /etc/profile.d/kube-conf.sh.orig
  +++ /etc/profile.d/kube-conf.sh
  @@ -3,7 +3,7 @@
   
   # kube environments
   export KUBE_ENV_ENVIRONMENTS="eqiad codfw staging staging-eqiad staging-codfw ml-serve-eqiad ml-serve-codfw ml-staging-codfw dse-k8s-eqiad dse-k8s-codfw aux-k8s-eqiad aux-k8s-codfw"
  -export KUBE_ENV_SERVICES="admin apertium api-gateway benthos-cache-invalidator changeprop changeprop-jobqueue chart-renderer cirrus-streaming-updater citoid commons-impact-analytics cxserver data-gateway developer-portal device-analytics echostore edit-analytics editor-analytics eventgate-analytics eventgate-analytics-external eventgate-logging-external eventgate-main eventstreams failoid-ng geo-analytics ipoid kartotherian linked-artifacts linkrecommendation machinetranslation mathoid media-analytics miscweb mobileapps mw-api-ext mw-api-int mw-cron mw-debug mw-experimental mw-jobrunner mw-mcrouter mw-misc mw-page-content-change-enrich mw-parsoid mw-script mw-videoscaler mw-web mw-wikifunctions opentelemetry-collector page-analytics proton push-notifications ratelimit rdf-streaming-updater recommendation-api rest-gateway sessionstore shellbox shellbox-constraints shellbox-media shellbox-syntaxhighlight shellbox-timeline shellbox-video tegola-vector-tiles termbox thumbor toolhub wikidata-query-gui wikifeeds wikifunctions zotero article-descriptions article-models articletopic-outlink edit-check experimental llm logo-detection ores-legacy readability recommendation-api-ng revertrisk revise-tone-task-generator revision-models revscoring-articlequality revscoring-articletopic revscoring-draftquality revscoring-drafttopic revscoring-editquality-damaging revscoring-editquality-goodfaith revscoring-editquality-reverted analytics analytics-test kafka-mirrormaker kafka-ui opensearch-ipoid opensearch-ipoid-test opensearch-operator opensearch-operator-3 opensearch-semantic-search opensearch-semantic-search-test opensearch-test opensearch-toolhub opensearch-toolhub-test opensearch-apifeatureusage opensearch-apifeatureusage-test opensearch-ttmserver opensearch-ttmserver-test wdqs-internal wdqs-internal-next wdqs-external wdqs-external-next echoserver airflow-analytics-product airflow-analytics-test airflow-dev airflow-fr-tech airflow-main airflow-ml airflow-platform-eng airflow-research airflow-search airflow-sre airflow-test-k8s airflow-wikidata airflow-wmde blunderbuss datahub datahub-next datasets-config datasets-config-next eventstreams-internal growthbook growthbook-next llm-inference mediawiki-dumps-legacy mw-content-history-reconcile-enrich mw-content-history-reconcile-enrich-next mw-dump-rev-content-reconcile-enrich mw-dump-rev-content-reconcile-enrich-next mw-page-html-content-change-enrich mw-page-html-content-change-enrich-next mw-page-html-feature-counts-change-enrich mw-page-html-feature-counts-change-enrich-next spark spark-history spark-history-test superset superset-next test-kitchen test-kitchen-next turnilo turnilo-next webrequest-page-view webrequest-page-view-next wdqs-queryhammer codesearch jaeger redioscope sophroid zarcillo"
  +export KUBE_ENV_SERVICES="admin apertium api-gateway benthos-cache-invalidator changeprop changeprop-jobqueue chart-renderer cirrus-streaming-updater citoid commons-impact-analytics cxserver data-gateway developer-portal device-analytics echostore edit-analytics editor-analytics eventgate-analytics eventgate-analytics-external eventgate-logging-external eventgate-main eventstreams failoid-ng geo-analytics ipoid kartotherian linked-artifacts linkrecommendation machinetranslation mathoid media-analytics miscweb mobileapps mw-api-ext mw-api-int mw-cron mw-debug mw-experimental mw-jobrunner mw-mcrouter mw-misc mw-page-content-change-enrich mw-parsoid mw-script mw-videoscaler mw-web mw-wikifunctions opentelemetry-collector page-analytics proton push-notifications ratelimit rdf-streaming-updater recommendation-api rest-gateway sessionstore shellbox shellbox-constraints shellbox-media shellbox-syntaxhighlight shellbox-timeline shellbox-video tegola-vector-tiles termbox thumbor toolhub wikidata-query-gui wikifeeds wikifunctions zotero article-descriptions article-models articletopic-outlink edit-check experimental llm logo-detection ores-legacy readability recommendation-api-ng revertrisk revise-tone-task-generator revision-models revscoring-articlequality revscoring-articletopic revscoring-draftquality revscoring-drafttopic revscoring-editquality-damaging revscoring-editquality-goodfaith revscoring-editquality-reverted analytics analytics-test kafka-mirrormaker kafka-ui opensearch-ipoid opensearch-ipoid-test opensearch-operator opensearch-operator-3 opensearch-semantic-search opensearch-semantic-search-test opensearch-test opensearch-toolhub opensearch-toolhub-test opensearch-apifeatureusage opensearch-apifeatureusage-test opensearch-ttmserver opensearch-ttmserver-test wdqs wdqs-next echoserver airflow-analytics-product airflow-analytics-test airflow-dev airflow-fr-tech airflow-main airflow-ml airflow-platform-eng airflow-research airflow-search airflow-sre airflow-test-k8s airflow-wikidata airflow-wmde blunderbuss datahub datahub-next datasets-config datasets-config-next eventstreams-internal growthbook growthbook-next llm-inference mediawiki-dumps-legacy mw-content-history-reconcile-enrich mw-content-history-reconcile-enrich-next mw-dump-rev-content-reconcile-enrich mw-dump-rev-content-reconcile-enrich-next mw-page-html-content-change-enrich mw-page-html-content-change-enrich-next mw-page-html-feature-counts-change-enrich mw-page-html-feature-counts-change-enrich-next spark spark-history spark-history-test superset superset-next test-kitchen test-kitchen-next turnilo turnilo-next webrequest-page-view webrequest-page-view-next wdqs-queryhammer codesearch jaeger redioscope sophroid zarcillo"
   
   # Array that maps kubernetes environments to their respective versions
   # This duplicated information from KUBE_ENV_ENVIRONMENTS, but I did not want to break existing scripts

• Cfssl::Cert[dse__wdqs]

  Parameters differences:

  --- Cfssl::Cert[dse__wdqs].orig
  +++ Cfssl::Cert[dse__wdqs]
  
  +    notify_services => []
  +    renew_seconds   => 952200
  +    names           => [{'organisation': 'view'}]
  +    key             => {'algo': 'ecdsa', 'size': 256}
  +    auto_renew      => True
  +    owner           => mwdeploy
  +    provide_chain   => True
  +    mode            => 0740
  +    common_name     => wdqs
  +    label           => dse
  +    ensure          => present
  +    environment     => ['GODEBUG=x509ignoreCN=0']
  +    group           => deployment
  +    outdir          => /etc/kubernetes/pki
  +    before_services => []
  +    hosts           => []
  

• File[/etc/kubernetes/wdqs-deploy-dse-k8s-codfw.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-deploy-dse-k8s-codfw.config].orig
  +++ File[/etc/kubernetes/wdqs-deploy-dse-k8s-codfw.config]
  
  +    mode   => 0640
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-deploy-dse-k8s-codfw.config.orig
  +++ /etc/kubernetes/wdqs-deploy-dse-k8s-codfw.config
  @@ -0,0 +1,19 @@
  +apiVersion: v1
  +kind: Config
  +preferences: {}
  +current-context: default-system
  +contexts:
  +- name: default-system
  +  context:
  +    cluster: default-cluster
  +    user: wdqs-deploy
  +    namespace: wdqs
  +clusters:
  +- name: default-cluster
  +  cluster:
  +    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
  +users:
  +- name: wdqs-deploy
  +  user:
  +    client-certificate: /etc/kubernetes/pki/dse__wdqs-deploy.pem
  +    client-key: /etc/kubernetes/pki/dse__wdqs-deploy-key.pem

• K8s::Kubeconfig[/etc/kubernetes/wdqs-dse-k8s-codfw.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-dse-k8s-codfw.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-dse-k8s-codfw.config]
  
  +    master_host => dse-k8s-ctrl.svc.codfw.wmnet
  +    require     => ['Class[K8s::Base_dirs]']
  +    owner       => mwdeploy
  +    namespace   => wdqs
  +    mode        => 0640
  +    ensure      => present
  +    username    => wdqs
  +    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs.chained.pem'}
  +    group       => deployment
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-dse-k8s-eqiad.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-dse-k8s-eqiad.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-dse-k8s-eqiad.config]
  
  -    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-internal-next
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-internal-next
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-internal-next.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-internal-next-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-internal-next.chained.pem'}
  -    group       => deployment
  

• File[/etc/kubernetes/wdqs-external-next-dse-k8s-codfw.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-external-next-dse-k8s-codfw.config].orig
  +++ File[/etc/kubernetes/wdqs-external-next-dse-k8s-codfw.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-external-next-dse-k8s-codfw.config.orig
  +++ /etc/kubernetes/wdqs-external-next-dse-k8s-codfw.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-external-next
  -    namespace: wdqs-external-next
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
  -users:
  -- name: wdqs-external-next
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-external-next.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-external-next-key.pem

• File[/etc/cfssl/csr/dse__wdqs-internal-deploy.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/dse__wdqs-internal-deploy.csr].orig
  +++ File[/etc/cfssl/csr/dse__wdqs-internal-deploy.csr]
  
  -    mode   => 0400
  -    owner  => root
  -    group  => root
  -    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/dse__wdqs-internal-deploy.csr.orig
  +++ /etc/cfssl/csr/dse__wdqs-internal-deploy.csr
  @@ -1,26 +0,0 @@
  -{
  -  "CN": "wdqs-internal-deploy",
  -  "hosts": [
  -    "wdqs-internal-deploy"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -    {
  -      "C": null,
  -      "L": null,
  -      "O": "view",
  -      "OU": null,
  -      "S": null
  -    },
  -    {
  -      "C": null,
  -      "L": null,
  -      "O": "deploy",
  -      "OU": null,
  -      "S": null
  -    }
  -  ]
  -}

• Cfssl::Cert[dse__wdqs-internal]

  Parameters differences:

  --- Cfssl::Cert[dse__wdqs-internal].orig
  +++ Cfssl::Cert[dse__wdqs-internal]
  
  -    notify_services => []
  -    renew_seconds   => 952200
  -    names           => [{'organisation': 'view'}]
  -    key             => {'algo': 'ecdsa', 'size': 256}
  -    auto_renew      => True
  -    owner           => mwdeploy
  -    provide_chain   => True
  -    mode            => 0740
  -    common_name     => wdqs-internal
  -    label           => dse
  -    ensure          => present
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    group           => deployment
  -    outdir          => /etc/kubernetes/pki
  -    before_services => []
  -    hosts           => []
  

• File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-internal-next]

  Parameters differences:

  --- File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-internal-next].orig
  +++ File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-internal-next]
  
  -    recurse => True
  -    owner   => mwdeploy
  -    mode    => 0751
  -    force   => True
  -    group   => deployment
  -    ensure  => directory
  

• Cfssl::Cert[dse__wdqs-external-deploy]

  Parameters differences:

  --- Cfssl::Cert[dse__wdqs-external-deploy].orig
  +++ Cfssl::Cert[dse__wdqs-external-deploy]
  
  -    notify_services => []
  -    renew_seconds   => 952200
  -    names           => [{'organisation': 'view'}, {'organisation': 'deploy'}]
  -    key             => {'algo': 'ecdsa', 'size': 256}
  -    auto_renew      => True
  -    owner           => mwdeploy
  -    provide_chain   => True
  -    mode            => 0740
  -    common_name     => wdqs-external-deploy
  -    label           => dse
  -    ensure          => present
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    group           => deployment
  -    outdir          => /etc/kubernetes/pki
  -    before_services => []
  -    hosts           => []
  

• File[/etc/cfssl/csr/dse__wdqs-deploy.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/dse__wdqs-deploy.csr].orig
  +++ File[/etc/cfssl/csr/dse__wdqs-deploy.csr]
  
  +    mode   => 0400
  +    owner  => root
  +    group  => root
  +    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/dse__wdqs-deploy.csr.orig
  +++ /etc/cfssl/csr/dse__wdqs-deploy.csr
  @@ -0,0 +1,26 @@
  +{
  +  "CN": "wdqs-deploy",
  +  "hosts": [
  +    "wdqs-deploy"
  +  ],
  +  "key": {
  +    "algo": "ecdsa",
  +    "size": 256
  +  },
  +  "names": [
  +    {
  +      "C": null,
  +      "L": null,
  +      "O": "view",
  +      "OU": null,
  +      "S": null
  +    },
  +    {
  +      "C": null,
  +      "L": null,
  +      "O": "deploy",
  +      "OU": null,
  +      "S": null
  +    }
  +  ]
  +}

• Exec[renew certificate - dse__wdqs-internal-next-deploy]

  Parameters differences:

  --- Exec[renew certificate - dse__wdqs-internal-next-deploy].orig
  +++ Exec[renew certificate - dse__wdqs-internal-next-deploy]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal-next-deploy
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.pem -checkend 952200
  -    require     => Exec[Generate cert dse__wdqs-internal-next-deploy]
  

• File[/etc/cfssl/csr/dse__wdqs-internal-next.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/dse__wdqs-internal-next.csr].orig
  +++ File[/etc/cfssl/csr/dse__wdqs-internal-next.csr]
  
  -    mode   => 0400
  -    owner  => root
  -    group  => root
  -    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/dse__wdqs-internal-next.csr.orig
  +++ /etc/cfssl/csr/dse__wdqs-internal-next.csr
  @@ -1,19 +0,0 @@
  -{
  -  "CN": "wdqs-internal-next",
  -  "hosts": [
  -    "wdqs-internal-next"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -    {
  -      "C": null,
  -      "L": null,
  -      "O": "view",
  -      "OU": null,
  -      "S": null
  -    }
  -  ]
  -}

• File[/etc/cfssl/csr/dse__wdqs-next-deploy.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/dse__wdqs-next-deploy.csr].orig
  +++ File[/etc/cfssl/csr/dse__wdqs-next-deploy.csr]
  
  +    mode   => 0400
  +    owner  => root
  +    group  => root
  +    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/dse__wdqs-next-deploy.csr.orig
  +++ /etc/cfssl/csr/dse__wdqs-next-deploy.csr
  @@ -0,0 +1,26 @@
  +{
  +  "CN": "wdqs-next-deploy",
  +  "hosts": [
  +    "wdqs-next-deploy"
  +  ],
  +  "key": {
  +    "algo": "ecdsa",
  +    "size": 256
  +  },
  +  "names": [
  +    {
  +      "C": null,
  +      "L": null,
  +      "O": "view",
  +      "OU": null,
  +      "S": null
  +    },
  +    {
  +      "C": null,
  +      "L": null,
  +      "O": "deploy",
  +      "OU": null,
  +      "S": null
  +    }
  +  ]
  +}

• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/dse__wdqs.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/dse__wdqs.csr]
  
  +    key         => {'algo': 'ecdsa', 'size': 256}
  +    hosts       => []
  +    names       => [{'organisation': 'view'}]
  +    common_name => wdqs
  +    ensure      => present
  

• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-deploy.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-deploy.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-deploy.csr]
  
  -    key         => {'algo': 'ecdsa', 'size': 256}
  -    hosts       => []
  -    names       => [{'organisation': 'view'}, {'organisation': 'deploy'}]
  -    common_name => wdqs-internal-deploy
  -    ensure      => present
  

• Exec[Generate cert dse__wdqs-next-deploy refresh]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-next-deploy refresh].orig
  +++ Exec[Generate cert dse__wdqs-next-deploy refresh]
  
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-next-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-next-deploy
  
  +    refreshonly => True
  +    subscribe   => File[/etc/cfssl/csr/dse__wdqs-next-deploy.csr]
  +    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.pem]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• File[/etc/kubernetes/wdqs-dse-k8s-codfw.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-dse-k8s-codfw.config].orig
  +++ File[/etc/kubernetes/wdqs-dse-k8s-codfw.config]
  
  +    mode   => 0640
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-dse-k8s-codfw.config.orig
  +++ /etc/kubernetes/wdqs-dse-k8s-codfw.config
  @@ -0,0 +1,19 @@
  +apiVersion: v1
  +kind: Config
  +preferences: {}
  +current-context: default-system
  +contexts:
  +- name: default-system
  +  context:
  +    cluster: default-cluster
  +    user: wdqs
  +    namespace: wdqs
  +clusters:
  +- name: default-cluster
  +  cluster:
  +    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
  +users:
  +- name: wdqs
  +  user:
  +    client-certificate: /etc/kubernetes/pki/dse__wdqs.pem
  +    client-key: /etc/kubernetes/pki/dse__wdqs-key.pem

• Exec[Generate cert dse__wdqs refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs refresh on intermediate ca change].orig
  +++ Exec[Generate cert dse__wdqs refresh on intermediate ca change]
  
  +    refreshonly => True
  +    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs.csr]
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs
  
  +    subscribe   => File[/etc/kubernetes/pki/dse__wdqs.chain.pem]
  

• File[/etc/kubernetes/pki/dse__wdqs-external-deploy.chained.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-deploy.chained.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-deploy.chained.pem]
  
  -    owner   => mwdeploy
  -    require => Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem]
  -    group   => deployment
  -    ensure  => file
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-dse-k8s-codfw.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-dse-k8s-codfw.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-dse-k8s-codfw.config]
  
  -    master_host => dse-k8s-ctrl.svc.codfw.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-internal-next
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-internal-next
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-internal-next.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-internal-next-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-internal-next.chained.pem'}
  -    group       => deployment
  

• File[/etc/kubernetes/wdqs-dse-k8s-eqiad.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-dse-k8s-eqiad.config].orig
  +++ File[/etc/kubernetes/wdqs-dse-k8s-eqiad.config]
  
  +    mode   => 0640
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-dse-k8s-eqiad.config.orig
  +++ /etc/kubernetes/wdqs-dse-k8s-eqiad.config
  @@ -0,0 +1,19 @@
  +apiVersion: v1
  +kind: Config
  +preferences: {}
  +current-context: default-system
  +contexts:
  +- name: default-system
  +  context:
  +    cluster: default-cluster
  +    user: wdqs
  +    namespace: wdqs
  +clusters:
  +- name: default-cluster
  +  cluster:
  +    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
  +users:
  +- name: wdqs
  +  user:
  +    client-certificate: /etc/kubernetes/pki/dse__wdqs.pem
  +    client-key: /etc/kubernetes/pki/dse__wdqs-key.pem

• Exec[Generate cert dse__wdqs-internal-deploy]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-internal-deploy].orig
  +++ Exec[Generate cert dse__wdqs-internal-deploy]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-internal-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal-deploy
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-internal-deploy.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__wdqs-internal-deploy-key.pem 2>&1)"
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-deploy.csr]
  

• File[/etc/kubernetes/pki/dse__wdqs-next-deploy.csr]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-next-deploy.csr].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-next-deploy.csr]
  
  +    mode   => 0440
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => file
  

• File[/etc/kubernetes/pki/dse__wdqs-external.chain.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external.chain.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external.chain.pem]
  
  -    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
  -    owner  => mwdeploy
  -    mode   => 0440
  -    group  => deployment
  -    ensure => file
  

• File[/etc/kubernetes/wdqs-internal-next-dse-k8s-eqiad.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-internal-next-dse-k8s-eqiad.config].orig
  +++ File[/etc/kubernetes/wdqs-internal-next-dse-k8s-eqiad.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-internal-next-dse-k8s-eqiad.config.orig
  +++ /etc/kubernetes/wdqs-internal-next-dse-k8s-eqiad.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-internal-next
  -    namespace: wdqs-internal-next
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
  -users:
  -- name: wdqs-internal-next
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-internal-next.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-internal-next-key.pem

• File[/etc/kubernetes/pki/dse__wdqs-external-next.chain.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-next.chain.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-next.chain.pem]
  
  -    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
  -    owner  => mwdeploy
  -    mode   => 0440
  -    group  => deployment
  -    ensure => file
  

• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-next.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-next.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-next.csr]
  
  -    key         => {'algo': 'ecdsa', 'size': 256}
  -    hosts       => []
  -    names       => [{'organisation': 'view'}]
  -    common_name => wdqs-internal-next
  -    ensure      => present
  

• File[/etc/kubernetes/pki/dse__wdqs-key.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-key.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-key.pem]
  
  +    show_diff => False
  +    owner     => mwdeploy
  +    mode      => 0440
  +    backup    => False
  +    group     => deployment
  +    ensure    => file
  

• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal.chain.pem].orig
  +++ Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal.chain.pem]
  
  -    command   => /bin/cat /etc/kubernetes/pki/dse__wdqs-internal.pem /etc/kubernetes/pki/dse__wdqs-internal.chain.pem > /etc/kubernetes/pki/dse__wdqs-internal.chained.pem
  -    subscribe => ['Exec[renew certificate - dse__wdqs-internal]', 'File[/etc/kubernetes/pki/dse__wdqs-internal.chain.pem]', 'File[/etc/kubernetes/pki/dse__wdqs-internal.pem]']
  -    require   => Exec[Generate cert dse__wdqs-internal refresh on intermediate ca change]
  -    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-internal.pem /etc/kubernetes/pki/dse__wdqs-internal.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-internal.chained.pem | sha512sum)"
  
  

• File[/etc/kubernetes/pki/dse__wdqs-deploy-key.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-deploy-key.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-deploy-key.pem]
  
  +    show_diff => False
  +    owner     => mwdeploy
  +    mode      => 0440
  +    backup    => False
  +    group     => deployment
  +    ensure    => file
  

• Exec[Generate cert dse__wdqs-external refresh]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-external refresh].orig
  +++ Exec[Generate cert dse__wdqs-external refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-external.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external
  
  -    refreshonly => True
  -    subscribe   => File[/etc/cfssl/csr/dse__wdqs-external.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem]
  
  -    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
  -    owner  => mwdeploy
  -    mode   => 0440
  -    group  => deployment
  -    ensure => file
  

• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-next-deploy.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-next-deploy.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-next-deploy.csr]
  
  +    key         => {'algo': 'ecdsa', 'size': 256}
  +    hosts       => []
  +    names       => [{'organisation': 'view'}, {'organisation': 'deploy'}]
  +    common_name => wdqs-next-deploy
  +    ensure      => present
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-codfw.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-codfw.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-codfw.config]
  
  -    master_host => dse-k8s-ctrl.svc.codfw.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-internal-next
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-internal-next-deploy
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-internal-next-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chained.pem'}
  -    group       => deployment
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-dse-k8s-eqiad.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-external-dse-k8s-eqiad.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-external-dse-k8s-eqiad.config]
  
  -    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-external
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-external
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-external.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-external-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-external.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-external.chained.pem'}
  -    group       => deployment
  

• File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.pem]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• File[/etc/kubernetes/pki/dse__wdqs-next-deploy-key.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-next-deploy-key.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-next-deploy-key.pem]
  
  +    show_diff => False
  +    owner     => mwdeploy
  +    mode      => 0440
  +    backup    => False
  +    group     => deployment
  +    ensure    => file
  

• Cfssl::Cert[dse__wdqs-external-next]

  Parameters differences:

  --- Cfssl::Cert[dse__wdqs-external-next].orig
  +++ Cfssl::Cert[dse__wdqs-external-next]
  
  -    notify_services => []
  -    renew_seconds   => 952200
  -    names           => [{'organisation': 'view'}]
  -    key             => {'algo': 'ecdsa', 'size': 256}
  -    auto_renew      => True
  -    owner           => mwdeploy
  -    provide_chain   => True
  -    mode            => 0740
  -    common_name     => wdqs-external-next
  -    label           => dse
  -    ensure          => present
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    group           => deployment
  -    outdir          => /etc/kubernetes/pki
  -    before_services => []
  -    hosts           => []
  

• File[/etc/kubernetes/wdqs-next-dse-k8s-eqiad.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-next-dse-k8s-eqiad.config].orig
  +++ File[/etc/kubernetes/wdqs-next-dse-k8s-eqiad.config]
  
  +    mode   => 0640
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-next-dse-k8s-eqiad.config.orig
  +++ /etc/kubernetes/wdqs-next-dse-k8s-eqiad.config
  @@ -0,0 +1,19 @@
  +apiVersion: v1
  +kind: Config
  +preferences: {}
  +current-context: default-system
  +contexts:
  +- name: default-system
  +  context:
  +    cluster: default-cluster
  +    user: wdqs-next
  +    namespace: wdqs-next
  +clusters:
  +- name: default-cluster
  +  cluster:
  +    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
  +users:
  +- name: wdqs-next
  +  user:
  +    client-certificate: /etc/kubernetes/pki/dse__wdqs-next.pem
  +    client-key: /etc/kubernetes/pki/dse__wdqs-next-key.pem

• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-dse-k8s-eqiad.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-dse-k8s-eqiad.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-dse-k8s-eqiad.config]
  
  -    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-external-next
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-external-next
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-external-next.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-external-next-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-external-next.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-external-next.chained.pem'}
  -    group       => deployment
  

• Exec[Generate cert dse__wdqs-external]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-external].orig
  +++ Exec[Generate cert dse__wdqs-external]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-external.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-external.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__wdqs-external-key.pem 2>&1)"
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external.csr]
  

• File[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-eqiad.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-eqiad.config].orig
  +++ File[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-eqiad.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-external-next-deploy-dse-k8s-eqiad.config.orig
  +++ /etc/kubernetes/wdqs-external-next-deploy-dse-k8s-eqiad.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-external-next-deploy
  -    namespace: wdqs-external-next
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
  -users:
  -- name: wdqs-external-next-deploy
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-external-next-deploy.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-external-next-deploy-key.pem

• Exec[Generate cert dse__wdqs-external-deploy refresh]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-external-deploy refresh].orig
  +++ Exec[Generate cert dse__wdqs-external-deploy refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-external-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external-deploy
  
  -    refreshonly => True
  -    subscribe   => File[/etc/cfssl/csr/dse__wdqs-external-deploy.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/kubernetes/pki/dse__wdqs.csr]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs.csr].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs.csr]
  
  +    mode   => 0440
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => file
  

• Exec[Generate cert dse__wdqs-external-next refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-external-next refresh on intermediate ca change].orig
  +++ Exec[Generate cert dse__wdqs-external-next refresh on intermediate ca change]
  
  -    refreshonly => True
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-next.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-external-next.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external-next
  
  -    subscribe   => File[/etc/kubernetes/pki/dse__wdqs-external-next.chain.pem]
  

• File[/etc/kubernetes/pki/dse__wdqs-next-deploy.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-next-deploy.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-next-deploy.pem]
  
  +    mode   => 0440
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => file
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-eqiad.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-eqiad.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-eqiad.config]
  
  -    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-internal
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-internal-deploy
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-internal-deploy.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-internal-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-internal-deploy.chained.pem'}
  -    group       => deployment
  

• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem].orig
  +++ Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem]
  
  -    command   => /bin/cat /etc/kubernetes/pki/dse__wdqs-internal-next.pem /etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem > /etc/kubernetes/pki/dse__wdqs-internal-next.chained.pem
  -    subscribe => ['Exec[renew certificate - dse__wdqs-internal-next]', 'File[/etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem]', 'File[/etc/kubernetes/pki/dse__wdqs-internal-next.pem]']
  -    require   => Exec[Generate cert dse__wdqs-internal-next refresh on intermediate ca change]
  -    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-internal-next.pem /etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-internal-next.chained.pem | sha512sum)"
  
  

• File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.chained.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.chained.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.chained.pem]
  
  -    owner   => mwdeploy
  -    require => Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem]
  -    group   => deployment
  -    ensure  => file
  

• Exec[Generate cert dse__wdqs-deploy]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-deploy].orig
  +++ Exec[Generate cert dse__wdqs-deploy]
  
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-deploy
  
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-deploy.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__wdqs-deploy-key.pem 2>&1)"
  
  +    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-deploy.csr]
  

• Exec[renew certificate - dse__wdqs-internal-deploy]

  Parameters differences:

  --- Exec[renew certificate - dse__wdqs-internal-deploy].orig
  +++ Exec[renew certificate - dse__wdqs-internal-deploy]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__wdqs-internal-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal-deploy
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-internal-deploy.pem -checkend 952200
  -    require     => Exec[Generate cert dse__wdqs-internal-deploy]
  

• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-next.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-next.chain.pem].orig
  +++ Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-next.chain.pem]
  
  +    command   => /bin/cat /etc/kubernetes/pki/dse__wdqs-next.pem /etc/kubernetes/pki/dse__wdqs-next.chain.pem > /etc/kubernetes/pki/dse__wdqs-next.chained.pem
  +    subscribe => ['Exec[renew certificate - dse__wdqs-next]', 'File[/etc/kubernetes/pki/dse__wdqs-next.chain.pem]', 'File[/etc/kubernetes/pki/dse__wdqs-next.pem]']
  +    require   => Exec[Generate cert dse__wdqs-next refresh on intermediate ca change]
  +    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-next.pem /etc/kubernetes/pki/dse__wdqs-next.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-next.chained.pem | sha512sum)"
  
  

• File[/etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr].orig
  +++ File[/etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr]
  
  -    mode   => 0400
  -    owner  => root
  -    group  => root
  -    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr.orig
  +++ /etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr
  @@ -1,26 +0,0 @@
  -{
  -  "CN": "wdqs-internal-next-deploy",
  -  "hosts": [
  -    "wdqs-internal-next-deploy"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -    {
  -      "C": null,
  -      "L": null,
  -      "O": "view",
  -      "OU": null,
  -      "S": null
  -    },
  -    {
  -      "C": null,
  -      "L": null,
  -      "O": "deploy",
  -      "OU": null,
  -      "S": null
  -    }
  -  ]
  -}

• File[/etc/kubernetes/pki/dse__wdqs-internal-next.chained.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-next.chained.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-next.chained.pem]
  
  -    owner   => mwdeploy
  -    require => Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem]
  -    group   => deployment
  -    ensure  => file
  

• File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem]
  
  -    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
  -    owner  => mwdeploy
  -    mode   => 0440
  -    group  => deployment
  -    ensure => file
  

• File[/etc/cfssl/csr/dse__wdqs-external-next.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/dse__wdqs-external-next.csr].orig
  +++ File[/etc/cfssl/csr/dse__wdqs-external-next.csr]
  
  -    mode   => 0400
  -    owner  => root
  -    group  => root
  -    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/dse__wdqs-external-next.csr.orig
  +++ /etc/cfssl/csr/dse__wdqs-external-next.csr
  @@ -1,19 +0,0 @@
  -{
  -  "CN": "wdqs-external-next",
  -  "hosts": [
  -    "wdqs-external-next"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -    {
  -      "C": null,
  -      "L": null,
  -      "O": "view",
  -      "OU": null,
  -      "S": null
  -    }
  -  ]
  -}

• File[/etc/kubernetes/pki/dse__wdqs-deploy.chain.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-deploy.chain.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-deploy.chain.pem]
  
  +    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
  +    owner  => mwdeploy
  +    mode   => 0440
  +    group  => deployment
  +    ensure => file
  

• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-next.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-next.chain.pem].orig
  +++ Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-next.chain.pem]
  
  -    command   => /bin/cat /etc/kubernetes/pki/dse__wdqs-external-next.pem /etc/kubernetes/pki/dse__wdqs-external-next.chain.pem > /etc/kubernetes/pki/dse__wdqs-external-next.chained.pem
  -    subscribe => ['Exec[renew certificate - dse__wdqs-external-next]', 'File[/etc/kubernetes/pki/dse__wdqs-external-next.chain.pem]', 'File[/etc/kubernetes/pki/dse__wdqs-external-next.pem]']
  -    require   => Exec[Generate cert dse__wdqs-external-next refresh on intermediate ca change]
  -    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-external-next.pem /etc/kubernetes/pki/dse__wdqs-external-next.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-external-next.chained.pem | sha512sum)"
  
  

• File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.csr]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.csr].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.csr]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-next.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-next.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-next.csr]
  
  +    key         => {'algo': 'ecdsa', 'size': 256}
  +    hosts       => []
  +    names       => [{'organisation': 'view'}]
  +    common_name => wdqs-next
  +    ensure      => present
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-next-deploy-dse-k8s-eqiad.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-next-deploy-dse-k8s-eqiad.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-next-deploy-dse-k8s-eqiad.config]
  
  +    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
  +    require     => ['Class[K8s::Base_dirs]']
  +    owner       => mwdeploy
  +    namespace   => wdqs-next
  +    mode        => 0640
  +    ensure      => present
  +    username    => wdqs-next-deploy
  +    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-next-deploy.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-next-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-next-deploy.chained.pem'}
  +    group       => deployment
  

• File[/etc/kubernetes/pki/dse__wdqs.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs.pem]
  
  +    mode   => 0440
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => file
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-deploy-dse-k8s-eqiad.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-deploy-dse-k8s-eqiad.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-deploy-dse-k8s-eqiad.config]
  
  +    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
  +    require     => ['Class[K8s::Base_dirs]']
  +    owner       => mwdeploy
  +    namespace   => wdqs
  +    mode        => 0640
  +    ensure      => present
  +    username    => wdqs-deploy
  +    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-deploy.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-deploy.chained.pem'}
  +    group       => deployment
  

• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem].orig
  +++ Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem]
  
  -    command   => /bin/cat /etc/kubernetes/pki/dse__wdqs-external-deploy.pem /etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem > /etc/kubernetes/pki/dse__wdqs-external-deploy.chained.pem
  -    subscribe => ['Exec[renew certificate - dse__wdqs-external-deploy]', 'File[/etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem]', 'File[/etc/kubernetes/pki/dse__wdqs-external-deploy.pem]']
  -    require   => Exec[Generate cert dse__wdqs-external-deploy refresh on intermediate ca change]
  -    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-external-deploy.pem /etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-external-deploy.chained.pem | sha512sum)"
  
  

• File[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-eqiad.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-eqiad.config].orig
  +++ File[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-eqiad.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-internal-deploy-dse-k8s-eqiad.config.orig
  +++ /etc/kubernetes/wdqs-internal-deploy-dse-k8s-eqiad.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-internal-deploy
  -    namespace: wdqs-internal
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
  -users:
  -- name: wdqs-internal-deploy
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-internal-deploy.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-internal-deploy-key.pem

• File[/etc/kubernetes/wdqs-internal-dse-k8s-eqiad.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-internal-dse-k8s-eqiad.config].orig
  +++ File[/etc/kubernetes/wdqs-internal-dse-k8s-eqiad.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-internal-dse-k8s-eqiad.config.orig
  +++ /etc/kubernetes/wdqs-internal-dse-k8s-eqiad.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-internal
  -    namespace: wdqs-internal
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
  -users:
  -- name: wdqs-internal
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-internal.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-internal-key.pem

• Exec[Generate cert dse__wdqs-internal-next-deploy refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-internal-next-deploy refresh on intermediate ca change].orig
  +++ Exec[Generate cert dse__wdqs-internal-next-deploy refresh on intermediate ca change]
  
  -    refreshonly => True
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal-next-deploy
  
  -    subscribe   => File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem]
  

• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external.csr]
  
  -    key         => {'algo': 'ecdsa', 'size': 256}
  -    hosts       => []
  -    names       => [{'organisation': 'view'}]
  -    common_name => wdqs-external
  -    ensure      => present
  

• File[/etc/kubernetes/pki/dse__wdqs-external.csr]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external.csr].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external.csr]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-deploy.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-deploy.chain.pem].orig
  +++ Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-deploy.chain.pem]
  
  +    command   => /bin/cat /etc/kubernetes/pki/dse__wdqs-deploy.pem /etc/kubernetes/pki/dse__wdqs-deploy.chain.pem > /etc/kubernetes/pki/dse__wdqs-deploy.chained.pem
  +    subscribe => ['Exec[renew certificate - dse__wdqs-deploy]', 'File[/etc/kubernetes/pki/dse__wdqs-deploy.chain.pem]', 'File[/etc/kubernetes/pki/dse__wdqs-deploy.pem]']
  +    require   => Exec[Generate cert dse__wdqs-deploy refresh on intermediate ca change]
  +    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-deploy.pem /etc/kubernetes/pki/dse__wdqs-deploy.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-deploy.chained.pem | sha512sum)"
  
  

• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-next.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-next.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-next.csr]
  
  -    key         => {'algo': 'ecdsa', 'size': 256}
  -    hosts       => []
  -    names       => [{'organisation': 'view'}]
  -    common_name => wdqs-external-next
  -    ensure      => present
  

• File[/etc/kubernetes/pki/dse__wdqs-external-next-key.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-next-key.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-next-key.pem]
  
  -    show_diff => False
  -    owner     => mwdeploy
  -    mode      => 0440
  -    backup    => False
  -    group     => deployment
  -    ensure    => file
  

• File[/etc/kubernetes/wdqs-deploy-dse-k8s-eqiad.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-deploy-dse-k8s-eqiad.config].orig
  +++ File[/etc/kubernetes/wdqs-deploy-dse-k8s-eqiad.config]
  
  +    mode   => 0640
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-deploy-dse-k8s-eqiad.config.orig
  +++ /etc/kubernetes/wdqs-deploy-dse-k8s-eqiad.config
  @@ -0,0 +1,19 @@
  +apiVersion: v1
  +kind: Config
  +preferences: {}
  +current-context: default-system
  +contexts:
  +- name: default-system
  +  context:
  +    cluster: default-cluster
  +    user: wdqs-deploy
  +    namespace: wdqs
  +clusters:
  +- name: default-cluster
  +  cluster:
  +    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
  +users:
  +- name: wdqs-deploy
  +  user:
  +    client-certificate: /etc/kubernetes/pki/dse__wdqs-deploy.pem
  +    client-key: /etc/kubernetes/pki/dse__wdqs-deploy-key.pem

• File[/etc/kubernetes/pki/dse__wdqs-internal-next.csr]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-next.csr].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-next.csr]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-dse-k8s-eqiad.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-dse-k8s-eqiad.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-dse-k8s-eqiad.config]
  
  +    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
  +    require     => ['Class[K8s::Base_dirs]']
  +    owner       => mwdeploy
  +    namespace   => wdqs
  +    mode        => 0640
  +    ensure      => present
  +    username    => wdqs
  +    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs.chained.pem'}
  +    group       => deployment
  

• File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-next]

  Parameters differences:

  --- File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-next].orig
  +++ File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-next]
  
  +    recurse => True
  +    owner   => mwdeploy
  +    mode    => 0751
  +    force   => True
  +    group   => deployment
  +    ensure  => directory
  

• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-next-deploy.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-next-deploy.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-next-deploy.csr]
  
  -    key         => {'algo': 'ecdsa', 'size': 256}
  -    hosts       => []
  -    names       => [{'organisation': 'view'}, {'organisation': 'deploy'}]
  -    common_name => wdqs-external-next-deploy
  -    ensure      => present
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-dse-k8s-eqiad.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-dse-k8s-eqiad.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-dse-k8s-eqiad.config]
  
  -    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-internal
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-internal
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-internal.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-internal-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-internal.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-internal.chained.pem'}
  -    group       => deployment
  

• File[/etc/kubernetes/pki/dse__wdqs.chained.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs.chained.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs.chained.pem]
  
  +    owner   => mwdeploy
  +    require => Exec[create chained cert /etc/kubernetes/pki/dse__wdqs.chain.pem]
  +    group   => deployment
  +    ensure  => file
  

• File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs]

  Parameters differences:

  --- File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs].orig
  +++ File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs]
  
  +    recurse => True
  +    owner   => mwdeploy
  +    mode    => 0751
  +    force   => True
  +    group   => deployment
  +    ensure  => directory
  

• Exec[renew certificate - dse__wdqs-next-deploy]

  Parameters differences:

  --- Exec[renew certificate - dse__wdqs-next-deploy].orig
  +++ Exec[renew certificate - dse__wdqs-next-deploy]
  
  +    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__wdqs-next-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-next-deploy
  
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-next-deploy.pem -checkend 952200
  +    require     => Exec[Generate cert dse__wdqs-next-deploy]
  

• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem].orig
  +++ Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem]
  
  -    command   => /bin/cat /etc/kubernetes/pki/dse__wdqs-internal-deploy.pem /etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem > /etc/kubernetes/pki/dse__wdqs-internal-deploy.chained.pem
  -    subscribe => ['Exec[renew certificate - dse__wdqs-internal-deploy]', 'File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem]', 'File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.pem]']
  -    require   => Exec[Generate cert dse__wdqs-internal-deploy refresh on intermediate ca change]
  -    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-internal-deploy.pem /etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-internal-deploy.chained.pem | sha512sum)"
  
  

• Exec[Generate cert dse__wdqs-deploy refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-deploy refresh on intermediate ca change].orig
  +++ Exec[Generate cert dse__wdqs-deploy refresh on intermediate ca change]
  
  +    refreshonly => True
  +    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-deploy.csr]
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-deploy
  
  +    subscribe   => File[/etc/kubernetes/pki/dse__wdqs-deploy.chain.pem]
  

• File[/etc/kubernetes/wdqs-external-deploy-dse-k8s-codfw.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-external-deploy-dse-k8s-codfw.config].orig
  +++ File[/etc/kubernetes/wdqs-external-deploy-dse-k8s-codfw.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-external-deploy-dse-k8s-codfw.config.orig
  +++ /etc/kubernetes/wdqs-external-deploy-dse-k8s-codfw.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-external-deploy
  -    namespace: wdqs-external
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
  -users:
  -- name: wdqs-external-deploy
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-external-deploy.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-external-deploy-key.pem

• Exec[Generate cert dse__wdqs-external refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-external refresh on intermediate ca change].orig
  +++ Exec[Generate cert dse__wdqs-external refresh on intermediate ca change]
  
  -    refreshonly => True
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-external.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external
  
  -    subscribe   => File[/etc/kubernetes/pki/dse__wdqs-external.chain.pem]
  

• File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-external-next]

  Parameters differences:

  --- File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-external-next].orig
  +++ File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-external-next]
  
  -    recurse => True
  -    owner   => mwdeploy
  -    mode    => 0751
  -    force   => True
  -    group   => deployment
  -    ensure  => directory
  

• File[/etc/cfssl/csr/dse__wdqs-external.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/dse__wdqs-external.csr].orig
  +++ File[/etc/cfssl/csr/dse__wdqs-external.csr]
  
  -    mode   => 0400
  -    owner  => root
  -    group  => root
  -    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/dse__wdqs-external.csr.orig
  +++ /etc/cfssl/csr/dse__wdqs-external.csr
  @@ -1,19 +0,0 @@
  -{
  -  "CN": "wdqs-external",
  -  "hosts": [
  -    "wdqs-external"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -    {
  -      "C": null,
  -      "L": null,
  -      "O": "view",
  -      "OU": null,
  -      "S": null
  -    }
  -  ]
  -}

• Exec[Generate cert dse__wdqs-external-next-deploy refresh]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-external-next-deploy refresh].orig
  +++ Exec[Generate cert dse__wdqs-external-next-deploy refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-external-next-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external-next-deploy
  
  -    refreshonly => True
  -    subscribe   => File[/etc/cfssl/csr/dse__wdqs-external-next-deploy.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/kubernetes/pki/dse__wdqs-internal-deploy-key.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-deploy-key.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-deploy-key.pem]
  
  -    show_diff => False
  -    owner     => mwdeploy
  -    mode      => 0440
  -    backup    => False
  -    group     => deployment
  -    ensure    => file
  

• File[/etc/kubernetes/pki/dse__wdqs-next-key.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-next-key.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-next-key.pem]
  
  +    show_diff => False
  +    owner     => mwdeploy
  +    mode      => 0440
  +    backup    => False
  +    group     => deployment
  +    ensure    => file
  

• Exec[renew certificate - dse__wdqs-next]

  Parameters differences:

  --- Exec[renew certificate - dse__wdqs-next].orig
  +++ Exec[renew certificate - dse__wdqs-next]
  
  +    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__wdqs-next.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-next
  
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-next.pem -checkend 952200
  +    require     => Exec[Generate cert dse__wdqs-next]
  

• File[/etc/kubernetes/pki/dse__wdqs-next.csr]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-next.csr].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-next.csr]
  
  +    mode   => 0440
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => file
  

• Cfssl::Cert[dse__wdqs-next]

  Parameters differences:

  --- Cfssl::Cert[dse__wdqs-next].orig
  +++ Cfssl::Cert[dse__wdqs-next]
  
  +    notify_services => []
  +    renew_seconds   => 952200
  +    names           => [{'organisation': 'view'}]
  +    key             => {'algo': 'ecdsa', 'size': 256}
  +    auto_renew      => True
  +    owner           => mwdeploy
  +    provide_chain   => True
  +    mode            => 0740
  +    common_name     => wdqs-next
  +    label           => dse
  +    ensure          => present
  +    environment     => ['GODEBUG=x509ignoreCN=0']
  +    group           => deployment
  +    outdir          => /etc/kubernetes/pki
  +    before_services => []
  +    hosts           => []
  

• File[/etc/helmfile-defaults/services-dse-k8s-eqiad.yaml]

  Content differences:

  --- /etc/helmfile-defaults/services-dse-k8s-eqiad.yaml.orig
  +++ /etc/helmfile-defaults/services-dse-k8s-eqiad.yaml
  @@ -76,22 +76,14 @@
       usernames:
       - name: opensearch-ttmserver-test
       - name: opensearch-ttmserver-test-deploy
  -  wdqs-internal:
  -    usernames:
  -    - name: wdqs-internal
  -    - name: wdqs-internal-deploy
  -  wdqs-internal-next:
  -    usernames:
  -    - name: wdqs-internal-next
  -    - name: wdqs-internal-next-deploy
  -  wdqs-external:
  -    usernames:
  -    - name: wdqs-external
  -    - name: wdqs-external-deploy
  -  wdqs-external-next:
  -    usernames:
  -    - name: wdqs-external-next
  -    - name: wdqs-external-next-deploy
  +  wdqs:
  +    usernames:
  +    - name: wdqs
  +    - name: wdqs-deploy
  +  wdqs-next:
  +    usernames:
  +    - name: wdqs-next
  +    - name: wdqs-next-deploy
     airflow-analytics-product:
       private_files:
         group: airflow-deployers

• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-deploy.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-deploy.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-deploy.csr]
  
  +    key         => {'algo': 'ecdsa', 'size': 256}
  +    hosts       => []
  +    names       => [{'organisation': 'view'}, {'organisation': 'deploy'}]
  +    common_name => wdqs-deploy
  +    ensure      => present
  

• File[/etc/kubernetes/pki/dse__wdqs-deploy.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-deploy.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-deploy.pem]
  
  +    mode   => 0440
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => file
  

• File[/etc/cfssl/csr/dse__wdqs.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/dse__wdqs.csr].orig
  +++ File[/etc/cfssl/csr/dse__wdqs.csr]
  
  +    mode   => 0400
  +    owner  => root
  +    group  => root
  +    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/dse__wdqs.csr.orig
  +++ /etc/cfssl/csr/dse__wdqs.csr
  @@ -0,0 +1,19 @@
  +{
  +  "CN": "wdqs",
  +  "hosts": [
  +    "wdqs"
  +  ],
  +  "key": {
  +    "algo": "ecdsa",
  +    "size": 256
  +  },
  +  "names": [
  +    {
  +      "C": null,
  +      "L": null,
  +      "O": "view",
  +      "OU": null,
  +      "S": null
  +    }
  +  ]
  +}

• File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.csr]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.csr].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.csr]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• File[/etc/kubernetes/pki/dse__wdqs-internal-key.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-key.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-key.pem]
  
  -    show_diff => False
  -    owner     => mwdeploy
  -    mode      => 0440
  -    backup    => False
  -    group     => deployment
  -    ensure    => file
  

• File[/etc/kubernetes/pki/dse__wdqs-internal.chained.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal.chained.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal.chained.pem]
  
  -    owner   => mwdeploy
  -    require => Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal.chain.pem]
  -    group   => deployment
  -    ensure  => file
  

• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr]
  
  -    key         => {'algo': 'ecdsa', 'size': 256}
  -    hosts       => []
  -    names       => [{'organisation': 'view'}, {'organisation': 'deploy'}]
  -    common_name => wdqs-internal-next-deploy
  -    ensure      => present
  

• Cfssl::Cert[dse__wdqs-deploy]

  Parameters differences:

  --- Cfssl::Cert[dse__wdqs-deploy].orig
  +++ Cfssl::Cert[dse__wdqs-deploy]
  
  +    notify_services => []
  +    renew_seconds   => 952200
  +    names           => [{'organisation': 'view'}, {'organisation': 'deploy'}]
  +    key             => {'algo': 'ecdsa', 'size': 256}
  +    auto_renew      => True
  +    owner           => mwdeploy
  +    provide_chain   => True
  +    mode            => 0740
  +    common_name     => wdqs-deploy
  +    label           => dse
  +    ensure          => present
  +    environment     => ['GODEBUG=x509ignoreCN=0']
  +    group           => deployment
  +    outdir          => /etc/kubernetes/pki
  +    before_services => []
  +    hosts           => []
  

• Exec[Generate cert dse__wdqs-internal-next refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-internal-next refresh on intermediate ca change].orig
  +++ Exec[Generate cert dse__wdqs-internal-next refresh on intermediate ca change]
  
  -    refreshonly => True
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-next.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-internal-next.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal-next
  
  -    subscribe   => File[/etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem]
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-dse-k8s-codfw.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-external-dse-k8s-codfw.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-external-dse-k8s-codfw.config]
  
  -    master_host => dse-k8s-ctrl.svc.codfw.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-external
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-external
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-external.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-external-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-external.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-external.chained.pem'}
  -    group       => deployment
  

• File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chained.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chained.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chained.pem]
  
  -    owner   => mwdeploy
  -    require => Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem]
  -    group   => deployment
  -    ensure  => file
  

• File[/etc/cfssl/csr/dse__wdqs-internal.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/dse__wdqs-internal.csr].orig
  +++ File[/etc/cfssl/csr/dse__wdqs-internal.csr]
  
  -    mode   => 0400
  -    owner  => root
  -    group  => root
  -    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/dse__wdqs-internal.csr.orig
  +++ /etc/cfssl/csr/dse__wdqs-internal.csr
  @@ -1,19 +0,0 @@
  -{
  -  "CN": "wdqs-internal",
  -  "hosts": [
  -    "wdqs-internal"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -    {
  -      "C": null,
  -      "L": null,
  -      "O": "view",
  -      "OU": null,
  -      "S": null
  -    }
  -  ]
  -}

• K8s::Kubeconfig[/etc/kubernetes/wdqs-deploy-dse-k8s-codfw.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-deploy-dse-k8s-codfw.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-deploy-dse-k8s-codfw.config]
  
  +    master_host => dse-k8s-ctrl.svc.codfw.wmnet
  +    require     => ['Class[K8s::Base_dirs]']
  +    owner       => mwdeploy
  +    namespace   => wdqs
  +    mode        => 0640
  +    ensure      => present
  +    username    => wdqs-deploy
  +    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-deploy.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-deploy.chained.pem'}
  +    group       => deployment
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-next-dse-k8s-eqiad.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-next-dse-k8s-eqiad.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-next-dse-k8s-eqiad.config]
  
  +    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
  +    require     => ['Class[K8s::Base_dirs]']
  +    owner       => mwdeploy
  +    namespace   => wdqs-next
  +    mode        => 0640
  +    ensure      => present
  +    username    => wdqs-next
  +    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-next.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-next-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-next.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-next.chained.pem'}
  +    group       => deployment
  

• Exec[renew certificate - dse__wdqs-internal]

  Parameters differences:

  --- Exec[renew certificate - dse__wdqs-internal].orig
  +++ Exec[renew certificate - dse__wdqs-internal]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__wdqs-internal.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-internal.pem -checkend 952200
  -    require     => Exec[Generate cert dse__wdqs-internal]
  

• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/kubernetes/pki/dse__wdqs.chain.pem].orig
  +++ Exec[create chained cert /etc/kubernetes/pki/dse__wdqs.chain.pem]
  
  +    command   => /bin/cat /etc/kubernetes/pki/dse__wdqs.pem /etc/kubernetes/pki/dse__wdqs.chain.pem > /etc/kubernetes/pki/dse__wdqs.chained.pem
  +    subscribe => ['Exec[renew certificate - dse__wdqs]', 'File[/etc/kubernetes/pki/dse__wdqs.chain.pem]', 'File[/etc/kubernetes/pki/dse__wdqs.pem]']
  +    require   => Exec[Generate cert dse__wdqs refresh on intermediate ca change]
  +    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__wdqs.pem /etc/kubernetes/pki/dse__wdqs.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__wdqs.chained.pem | sha512sum)"
  
  

• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem].orig
  +++ Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem]
  
  +    command   => /bin/cat /etc/kubernetes/pki/dse__wdqs-next-deploy.pem /etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem > /etc/kubernetes/pki/dse__wdqs-next-deploy.chained.pem
  +    subscribe => ['Exec[renew certificate - dse__wdqs-next-deploy]', 'File[/etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem]', 'File[/etc/kubernetes/pki/dse__wdqs-next-deploy.pem]']
  +    require   => Exec[Generate cert dse__wdqs-next-deploy refresh on intermediate ca change]
  +    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-next-deploy.pem /etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-next-deploy.chained.pem | sha512sum)"
  
  

• File[/etc/kubernetes/pki/dse__wdqs.chain.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs.chain.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs.chain.pem]
  
  +    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
  +    owner  => mwdeploy
  +    mode   => 0440
  +    group  => deployment
  +    ensure => file
  

• File[/etc/kubernetes/pki/dse__wdqs-external-deploy.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-deploy.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-deploy.pem]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy-key.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy-key.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy-key.pem]
  
  -    show_diff => False
  -    owner     => mwdeploy
  -    mode      => 0440
  -    backup    => False
  -    group     => deployment
  -    ensure    => file
  

• Exec[Generate cert dse__wdqs-internal-next-deploy]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-internal-next-deploy].orig
  +++ Exec[Generate cert dse__wdqs-internal-next-deploy]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal-next-deploy
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__wdqs-internal-next-deploy-key.pem 2>&1)"
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-next-deploy.csr]
  

• Cfssl::Cert[dse__wdqs-internal-next]

  Parameters differences:

  --- Cfssl::Cert[dse__wdqs-internal-next].orig
  +++ Cfssl::Cert[dse__wdqs-internal-next]
  
  -    notify_services => []
  -    renew_seconds   => 952200
  -    names           => [{'organisation': 'view'}]
  -    key             => {'algo': 'ecdsa', 'size': 256}
  -    auto_renew      => True
  -    owner           => mwdeploy
  -    provide_chain   => True
  -    mode            => 0740
  -    common_name     => wdqs-internal-next
  -    label           => dse
  -    ensure          => present
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    group           => deployment
  -    outdir          => /etc/kubernetes/pki
  -    before_services => []
  -    hosts           => []
  

• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal.csr]
  
  -    key         => {'algo': 'ecdsa', 'size': 256}
  -    hosts       => []
  -    names       => [{'organisation': 'view'}]
  -    common_name => wdqs-internal
  -    ensure      => present
  

• Exec[Generate cert dse__wdqs-next]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-next].orig
  +++ Exec[Generate cert dse__wdqs-next]
  
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-next.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-next
  
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-next.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__wdqs-next-key.pem 2>&1)"
  
  +    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-next.csr]
  

• File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy-key.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy-key.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy-key.pem]
  
  -    show_diff => False
  -    owner     => mwdeploy
  -    mode      => 0440
  -    backup    => False
  -    group     => deployment
  -    ensure    => file
  

• File[/etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-next.chain.pem]
  
  -    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
  -    owner  => mwdeploy
  -    mode   => 0440
  -    group  => deployment
  -    ensure => file
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-deploy-dse-k8s-eqiad.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-external-deploy-dse-k8s-eqiad.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-external-deploy-dse-k8s-eqiad.config]
  
  -    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-external
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-external-deploy
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-external-deploy.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-external-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-external-deploy.chained.pem'}
  -    group       => deployment
  

• Exec[Generate cert dse__wdqs-external-deploy refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-external-deploy refresh on intermediate ca change].orig
  +++ Exec[Generate cert dse__wdqs-external-deploy refresh on intermediate ca change]
  
  -    refreshonly => True
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-deploy.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-external-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external-deploy
  
  -    subscribe   => File[/etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem]
  

• File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-external]

  Parameters differences:

  --- File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-external].orig
  +++ File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-external]
  
  -    recurse => True
  -    owner   => mwdeploy
  -    mode    => 0751
  -    force   => True
  -    group   => deployment
  -    ensure  => directory
  

• Exec[Generate cert dse__wdqs-external-deploy]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-external-deploy].orig
  +++ Exec[Generate cert dse__wdqs-external-deploy]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-external-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external-deploy
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-external-deploy.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__wdqs-external-deploy-key.pem 2>&1)"
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-deploy.csr]
  

• Exec[renew certificate - dse__wdqs-external-deploy]

  Parameters differences:

  --- Exec[renew certificate - dse__wdqs-external-deploy].orig
  +++ Exec[renew certificate - dse__wdqs-external-deploy]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__wdqs-external-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external-deploy
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-external-deploy.pem -checkend 952200
  -    require     => Exec[Generate cert dse__wdqs-external-deploy]
  

• File[/etc/kubernetes/pki/dse__wdqs-external-next.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-next.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-next.pem]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• File[/etc/kubernetes/wdqs-external-next-dse-k8s-eqiad.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-external-next-dse-k8s-eqiad.config].orig
  +++ File[/etc/kubernetes/wdqs-external-next-dse-k8s-eqiad.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-external-next-dse-k8s-eqiad.config.orig
  +++ /etc/kubernetes/wdqs-external-next-dse-k8s-eqiad.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-external-next
  -    namespace: wdqs-external-next
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
  -users:
  -- name: wdqs-external-next
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-external-next.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-external-next-key.pem

• File[/etc/kubernetes/wdqs-external-deploy-dse-k8s-eqiad.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-external-deploy-dse-k8s-eqiad.config].orig
  +++ File[/etc/kubernetes/wdqs-external-deploy-dse-k8s-eqiad.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-external-deploy-dse-k8s-eqiad.config.orig
  +++ /etc/kubernetes/wdqs-external-deploy-dse-k8s-eqiad.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-external-deploy
  -    namespace: wdqs-external
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
  -users:
  -- name: wdqs-external-deploy
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-external-deploy.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-external-deploy-key.pem

• File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-internal]

  Parameters differences:

  --- File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-internal].orig
  +++ File[/etc/helmfile-defaults/private/dse-k8s_services/wdqs-internal]
  
  -    recurse => True
  -    owner   => mwdeploy
  -    mode    => 0751
  -    force   => True
  -    group   => deployment
  -    ensure  => directory
  

• Class[Profile::Kubernetes::Deployment_server::Helmfile]

  Parameters differences:

  --- Class[Profile::Kubernetes::Deployment_server::Helmfile].orig
  +++ Class[Profile::Kubernetes::Deployment_server::Helmfile]
  
  @@
  -    services => {'main': {'apertium': {'usernames': [{'name': 'apertium'}, {'name': 'apertium-deploy'}]}, 'api-gateway': {'usernames': [{'name': 'api-gateway'}, {'name': 'api-gateway-deploy'}]}, 'benthos-cache-invalidator': {'usernames': [{'name': 'benthos-cache-invalidator'}, {'name': 'benthos-cache-invalidator-deploy'}]}, 'changeprop': {'usernames': [{'name': 'changeprop'}, {'name': 'changeprop-deploy'}]}, 'changeprop-jobqueue': {'usernames': [{'name': 'changeprop-jobqueue'}, {'name': 'changeprop-jobqueue-deploy'}]}, 'chart-renderer': {'usernames': [{'name': 'chart-renderer'}, {'name': 'chart-renderer-deploy'}]}, 'cirrus-streaming-updater': {'usernames': [{'name': 'cirrus-streaming-updater'}, {'name': 'cirrus-streaming-updater-deploy'}]}, 'citoid': {'usernames': [{'name': 'citoid'}, {'name': 'citoid-deploy'}]}, 'commons-impact-analytics': {'usernames': [{'name': 'commons-impact-analytics'}, {'name': 'commons-impact-analytics-deploy'}]}, 'cxserver': {'usernames': [{'name': 'cxserver'}, {'name': 'cxserver-deploy'}]}, 'data-gateway': {'usernames': [{'name': 'data-gateway'}, {'name': 'data-gateway-deploy'}]}, 'developer-portal': {'usernames': [{'name': 'developer-portal'}, {'name': 'developer-portal-deploy'}]}, 'device-analytics': {'usernames': [{'name': 'device-analytics'}, {'name': 'device-analytics-deploy'}]}, 'echostore': {'usernames': [{'name': 'echostore'}, {'name': 'echostore-deploy'}]}, 'edit-analytics': {'usernames': [{'name': 'edit-analytics'}, {'name': 'edit-analytics-deploy'}]}, 'editor-analytics': {'usernames': [{'name': 'editor-analytics'}, {'name': 'editor-analytics-deploy'}]}, 'eventgate-analytics': {'usernames': [{'name': 'eventgate-analytics'}, {'name': 'eventgate-analytics-deploy'}]}, 'eventgate-analytics-external': {'usernames': [{'name': 'eventgate-analytics-external'}, {'name': 'eventgate-analytics-external-deploy'}]}, 'eventgate-logging-external': {'usernames': [{'name': 'eventgate-logging-external'}, {'name': 'eventgate-logging-external-deploy'}]}, 'eventgate-main': {'usernames': [{'name': 'eventgate-main'}, {'name': 'eventgate-main-deploy'}]}, 'eventstreams': {'usernames': [{'name': 'eventstreams'}, {'name': 'eventstreams-deploy'}]}, 'failoid-ng': {'usernames': [{'name': 'failoid-ng'}, {'name': 'failoid-ng-deploy'}]}, 'geo-analytics': {'usernames': [{'name': 'geo-analytics'}, {'name': 'geo-analytics-deploy'}]}, 'ipoid': {'usernames': [{'name': 'ipoid'}, {'name': 'ipoid-deploy'}]}, 'kartotherian': {'usernames': [{'name': 'kartotherian'}, {'name': 'kartotherian-deploy'}]}, 'linked-artifacts': {'usernames': [{'name': 'linked-artifacts'}, {'name': 'linked-artifacts-deploy'}]}, 'linkrecommendation': {'usernames': [{'name': 'linkrecommendation'}, {'name': 'linkrecommendation-deploy'}]}, 'machinetranslation': {'usernames': [{'name': 'machinetranslation'}, {'name': 'machinetranslation-deploy'}]}, 'mathoid': {'usernames': [{'name': 'mathoid'}, {'name': 'mathoid-deploy'}]}, 'media-analytics': {'usernames': [{'name': 'media-analytics'}, {'name': 'media-analytics-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'mobileapps': {'usernames': [{'name': 'mobileapps'}, {'name': 'mobileapps-deploy'}]}, 'mw-api-ext': {'usernames': [{'name': 'mw-api-ext'}, {'name': 'mw-api-ext-deploy'}]}, 'mw-api-int': {'usernames': [{'name': 'mw-api-int'}, {'name': 'mw-api-int-deploy'}]}, 'mw-cron': {'usernames': [{'name': 'mw-cron'}, {'name': 'mw-cron-deploy'}, {'group': 'restricted', 'name': 'mw-cron-restricted'}, {'group': 'restricted', 'name': 'mw-cron-restricted-deploy'}]}, 'mw-debug': {'usernames': [{'name': 'mw-debug'}, {'name': 'mw-debug-deploy'}]}, 'mw-experimental': {'usernames': [{'name': 'mw-experimental'}, {'name': 'mw-experimental-deploy'}]}, 'mw-jobrunner': {'usernames': [{'name': 'mw-jobrunner'}, {'name': 'mw-jobrunner-deploy'}]}, 'mw-mcrouter': {'usernames': [{'name': 'mw-mcrouter'}, {'name': 'mw-mcrouter-deploy'}]}, 'mw-misc': {'usernames': [{'name': 'mw-misc'}, {'name': 'mw-misc-deploy'}]}, 'mw-page-content-change-enrich': {'usernames': [{'name': 'mw-page-content-change-enrich'}, {'name': 'mw-page-content-change-enrich-deploy'}]}, 'mw-parsoid': {'usernames': [{'name': 'mw-parsoid'}, {'name': 'mw-parsoid-deploy'}]}, 'mw-script': {'usernames': [{'name': 'mw-script'}, {'name': 'mw-script-deploy'}, {'group': 'restricted', 'name': 'mw-script-restricted'}, {'group': 'restricted', 'name': 'mw-script-restricted-deploy'}]}, 'mw-videoscaler': {'usernames': [{'name': 'mw-videoscaler'}, {'name': 'mw-videoscaler-deploy'}]}, 'mw-web': {'usernames': [{'name': 'mw-web'}, {'name': 'mw-web-deploy'}]}, 'mw-wikifunctions': {'usernames': [{'name': 'mw-wikifunctions'}, {'name': 'mw-wikifunctions-deploy'}]}, 'opentelemetry-collector': {'usernames': [{'name': 'opentelemetry-collector'}, {'name': 'opentelemetry-collector-deploy'}]}, 'page-analytics': {'usernames': [{'name': 'page-analytics'}, {'name': 'page-analytics-deploy'}]}, 'proton': {'usernames': [{'name': 'proton'}, {'name': 'proton-deploy'}]}, 'push-notifications': {'usernames': [{'name': 'push-notifications'}, {'name': 'push-notifications-deploy'}]}, 'ratelimit': {'usernames': [{'name': 'ratelimit'}, {'name': 'ratelimit-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'recommendation-api': {'usernames': [{'name': 'recommendation-api'}, {'name': 'recommendation-api-deploy'}]}, 'rest-gateway': {'usernames': [{'name': 'rest-gateway'}, {'name': 'rest-gateway-deploy'}]}, 'sessionstore': {'usernames': [{'name': 'sessionstore'}, {'name': 'sessionstore-deploy'}]}, 'shellbox': {'usernames': [{'name': 'shellbox'}, {'name': 'shellbox-deploy'}]}, 'shellbox-constraints': {'usernames': [{'name': 'shellbox-constraints'}, {'name': 'shellbox-constraints-deploy'}]}, 'shellbox-media': {'usernames': [{'name': 'shellbox-media'}, {'name': 'shellbox-media-deploy'}]}, 'shellbox-syntaxhighlight': {'usernames': [{'name': 'shellbox-syntaxhighlight'}, {'name': 'shellbox-syntaxhighlight-deploy'}]}, 'shellbox-timeline': {'usernames': [{'name': 'shellbox-timeline'}, {'name': 'shellbox-timeline-deploy'}]}, 'shellbox-video': {'usernames': [{'name': 'shellbox-video'}, {'name': 'shellbox-video-deploy'}]}, 'tegola-vector-tiles': {'usernames': [{'name': 'tegola-vector-tiles'}, {'name': 'tegola-vector-tiles-deploy'}]}, 'termbox': {'usernames': [{'name': 'termbox'}, {'name': 'termbox-deploy'}]}, 'thumbor': {'usernames': [{'name': 'thumbor'}, {'name': 'thumbor-deploy'}]}, 'toolhub': {'usernames': [{'name': 'toolhub'}, {'name': 'toolhub-deploy'}]}, 'wikidata-query-gui': {'usernames': [{'name': 'wikidata-query-gui'}, {'name': 'wikidata-query-gui-deploy'}]}, 'wikifeeds': {'usernames': [{'name': 'wikifeeds'}, {'name': 'wikifeeds-deploy'}]}, 'wikifunctions': {'usernames': [{'name': 'wikifunctions'}, {'name': 'wikifunctions-deploy'}]}, 'zotero': {'usernames': [{'name': 'zotero'}, {'name': 'zotero-deploy'}]}}, 'ml-serve': {'article-descriptions': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-descriptions', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-descriptions-deploy', 'owner': 'root'}]}, 'article-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-models-deploy', 'owner': 'root'}]}, 'articletopic-outlink': {'usernames': [{'group': 'deploy-ml-service', 'name': 'articletopic-outlink', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'articletopic-outlink-deploy', 'owner': 'root'}]}, 'edit-check': {'usernames': [{'group': 'deploy-ml-service', 'name': 'edit-check', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'edit-check-deploy', 'owner': 'root'}]}, 'experimental': {'usernames': [{'group': 'deploy-ml-service', 'name': 'experimental', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-deploy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-debug', 'owner': 'root'}]}, 'llm': {'usernames': [{'group': 'deploy-ml-service', 'name': 'llm', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'llm-deploy', 'owner': 'root'}]}, 'logo-detection': {'usernames': [{'group': 'deploy-ml-service', 'name': 'logo-detection', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'logo-detection-deploy', 'owner': 'root'}]}, 'ores-legacy': {'usernames': [{'group': 'deploy-ml-service', 'name': 'ores-legacy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'ores-legacy-deploy', 'owner': 'root'}]}, 'readability': {'usernames': [{'group': 'deploy-ml-service', 'name': 'readability', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'readability-deploy', 'owner': 'root'}]}, 'recommendation-api-ng': {'usernames': [{'group': 'deploy-ml-service', 'name': 'recommendation-api-ng', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'recommendation-api-ng-deploy', 'owner': 'root'}]}, 'revertrisk': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revertrisk', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revertrisk-deploy', 'owner': 'root'}]}, 'revise-tone-task-generator': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator-deploy', 'owner': 'root'}]}, 'revision-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revision-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revision-models-deploy', 'owner': 'root'}]}, 'revscoring-articlequality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articlequality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articlequality-deploy', 'owner': 'root'}]}, 'revscoring-articletopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articletopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articletopic-deploy', 'owner': 'root'}]}, 'revscoring-draftquality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-draftquality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-draftquality-deploy', 'owner': 'root'}]}, 'revscoring-drafttopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic-deploy', 'owner': 'root'}]}, 'revscoring-editquality-damaging': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging-deploy', 'owner': 'root'}]}, 'revscoring-editquality-goodfaith': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith-deploy', 'owner': 'root'}]}, 'revscoring-editquality-reverted': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted-deploy', 'owner': 'root'}]}}, 'dse-k8s': {'analytics': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-deploy', 'owner': 'root'}]}, 'analytics-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-test-deploy', 'owner': 'root'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'kafka-ui': {'usernames': [{'name': 'kafka-ui'}, {'name': 'kafka-ui-deploy'}]}, 'opensearch-ipoid': {'usernames': [{'name': 'opensearch-ipoid'}, {'name': 'opensearch-ipoid-deploy'}]}, 'opensearch-ipoid-test': {'usernames': [{'name': 'opensearch-ipoid-test'}, {'name': 'opensearch-ipoid-test-deploy'}]}, 'opensearch-operator': {'usernames': [{'name': 'opensearch-operator'}, {'name': 'opensearch-operator-deploy'}]}, 'opensearch-operator-3': {'usernames': [{'name': 'opensearch-operator-3'}, {'name': 'opensearch-operator-3-deploy'}]}, 'opensearch-semantic-search': {'usernames': [{'name': 'opensearch-semantic-search'}, {'name': 'opensearch-semantic-search-deploy'}]}, 'opensearch-semantic-search-test': {'usernames': [{'name': 'opensearch-semantic-search-test'}, {'name': 'opensearch-semantic-search-test-deploy'}]}, 'opensearch-test': {'usernames': [{'name': 'opensearch-test'}, {'name': 'opensearch-test-deploy'}]}, 'opensearch-toolhub': {'usernames': [{'name': 'opensearch-toolhub'}, {'name': 'opensearch-toolhub-deploy'}]}, 'opensearch-toolhub-test': {'usernames': [{'name': 'opensearch-toolhub-test'}, {'name': 'opensearch-toolhub-test-deploy'}]}, 'opensearch-apifeatureusage': {'usernames': [{'name': 'opensearch-apifeatureusage'}, {'name': 'opensearch-apifeatureusage-deploy'}]}, 'opensearch-apifeatureusage-test': {'usernames': [{'name': 'opensearch-apifeatureusage-test'}, {'name': 'opensearch-apifeatureusage-test-deploy'}]}, 'opensearch-ttmserver': {'usernames': [{'name': 'opensearch-ttmserver'}, {'name': 'opensearch-ttmserver-deploy'}]}, 'opensearch-ttmserver-test': {'usernames': [{'name': 'opensearch-ttmserver-test'}, {'name': 'opensearch-ttmserver-test-deploy'}]}, 'wdqs-internal': {'usernames': [{'name': 'wdqs-internal'}, {'name': 'wdqs-internal-deploy'}]}, 'wdqs-internal-next': {'usernames': [{'name': 'wdqs-internal-next'}, {'name': 'wdqs-internal-next-deploy'}]}, 'wdqs-external': {'usernames': [{'name': 'wdqs-external'}, {'name': 'wdqs-external-deploy'}]}, 'wdqs-external-next': {'usernames': [{'name': 'wdqs-external-next'}, {'name': 'wdqs-external-next-deploy'}]}}, 'dse-k8s-codfw': {'echoserver': {'usernames': [{'name': 'echoserver'}, {'name': 'echoserver-deploy'}]}}, 'dse-k8s-eqiad': {'airflow-analytics-product': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-product', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-product-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product-deploy', 'owner': 'root'}]}, 'airflow-analytics-test': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-test', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-test-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test-deploy', 'owner': 'root'}]}, 'airflow-dev': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-dev', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-dev-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev-deploy', 'owner': 'root'}]}, 'airflow-fr-tech': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-fr-tech', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-fr-tech-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech-deploy', 'owner': 'root'}]}, 'airflow-main': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-main', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-main-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main-deploy', 'owner': 'root'}]}, 'airflow-ml': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-ml', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-ml-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml-deploy', 'owner': 'root'}]}, 'airflow-platform-eng': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-platform-eng', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-platform-eng-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng-deploy', 'owner': 'root'}]}, 'airflow-research': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-research', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-research-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research-deploy', 'owner': 'root'}]}, 'airflow-search': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-search', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-search-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search-deploy', 'owner': 'root'}]}, 'airflow-sre': {'private_files': {'group': 'ops', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-sre', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-sre-deploy', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre-deploy', 'owner': 'root'}]}, 'airflow-test-k8s': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-test-k8s', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-test-k8s-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s-deploy', 'owner': 'root'}]}, 'airflow-wikidata': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wikidata', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wikidata-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata-deploy', 'owner': 'root'}]}, 'airflow-wmde': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wmde', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wmde-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde-deploy', 'owner': 'root'}]}, 'blunderbuss': {'usernames': [{'name': 'blunderbuss'}, {'name': 'blunderbuss-deploy'}]}, 'datahub': {'usernames': [{'name': 'datahub'}, {'name': 'datahub-deploy'}]}, 'datahub-next': {'usernames': [{'name': 'datahub-next'}, {'name': 'datahub-next-deploy'}]}, 'datasets-config': {'usernames': [{'name': 'datasets-config'}, {'name': 'datasets-config-deploy'}]}, 'datasets-config-next': {'usernames': [{'name': 'datasets-config-next'}, {'name': 'datasets-config-next-deploy'}]}, 'eventstreams-internal': {'usernames': [{'name': 'eventstreams-internal'}, {'name': 'eventstreams-internal-deploy'}]}, 'growthbook': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-deploy', 'owner': 'root'}, {'name': 'growthbook'}, {'name': 'growthbook-deploy'}]}, 'growthbook-next': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook-next', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-next-deploy', 'owner': 'root'}, {'name': 'growthbook-next'}, {'name': 'growthbook-next-deploy'}]}, 'llm-inference': {'usernames': [{'group': 'research-deployers', 'name': 'llm-inference', 'owner': 'root'}, {'group': 'research-deployers', 'name': 'llm-inference-deploy', 'owner': 'root'}]}, 'mediawiki-dumps-legacy': {'usernames': [{'name': 'mediawiki-dumps-legacy'}, {'name': 'mediawiki-dumps-legacy-deploy'}]}, 'mw-content-history-reconcile-enrich': {'usernames': [{'name': 'mw-content-history-reconcile-enrich'}, {'name': 'mw-content-history-reconcile-enrich-deploy'}]}, 'mw-content-history-reconcile-enrich-next': {'usernames': [{'name': 'mw-content-history-reconcile-enrich-next'}, {'name': 'mw-content-history-reconcile-enrich-next-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich'}, {'name': 'mw-dump-rev-content-reconcile-enrich-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich-next': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich-next'}, {'name': 'mw-dump-rev-content-reconcile-enrich-next-deploy'}]}, 'mw-page-html-content-change-enrich': {'usernames': [{'name': 'mw-page-html-content-change-enrich'}, {'name': 'mw-page-html-content-change-enrich-deploy'}]}, 'mw-page-html-content-change-enrich-next': {'usernames': [{'name': 'mw-page-html-content-change-enrich-next'}, {'name': 'mw-page-html-content-change-enrich-next-deploy'}]}, 'mw-page-html-feature-counts-change-enrich': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich'}, {'name': 'mw-page-html-feature-counts-change-enrich-deploy'}]}, 'mw-page-html-feature-counts-change-enrich-next': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich-next'}, {'name': 'mw-page-html-feature-counts-change-enrich-next-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'spark': {'usernames': [{'name': 'spark'}, {'name': 'spark-deploy'}]}, 'spark-history': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-deploy', 'owner': 'root'}]}, 'spark-history-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-test-deploy', 'owner': 'root'}]}, 'superset': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-deploy', 'owner': 'root'}]}, 'superset-next': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset-next', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-next-deploy', 'owner': 'root'}]}, 'test-kitchen': {'usernames': [{'name': 'test-kitchen'}, {'name': 'test-kitchen-deploy'}]}, 'test-kitchen-next': {'usernames': [{'name': 'test-kitchen-next'}, {'name': 'test-kitchen-next-deploy'}]}, 'turnilo': {'usernames': [{'name': 'turnilo'}, {'name': 'turnilo-deploy'}]}, 'turnilo-next': {'usernames': [{'name': 'turnilo-next'}, {'name': 'turnilo-next-deploy'}]}, 'webrequest-page-view': {'usernames': [{'name': 'webrequest-page-view'}, {'name': 'webrequest-page-view-deploy'}]}, 'webrequest-page-view-next': {'usernames': [{'name': 'webrequest-page-view-next'}, {'name': 'webrequest-page-view-next-deploy'}]}, 'wdqs-queryhammer': {'usernames': [{'name': 'wdqs-queryhammer'}, {'name': 'wdqs-queryhammer-deploy'}]}}, 'aux-k8s': {'codesearch': {'usernames': [{'name': 'codesearch'}, {'name': 'codesearch-deploy'}]}, 'jaeger': {'usernames': [{'name': 'jaeger'}, {'name': 'jaeger-deploy'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'redioscope': {'usernames': [{'name': 'redioscope'}, {'name': 'redioscope-deploy'}]}, 'sophroid': {'usernames': [{'name': 'sophroid'}, {'name': 'sophroid-deploy'}]}, 'zarcillo': {'usernames': [{'name': 'zarcillo'}, {'name': 'zarcillo-deploy'}]}}}
  +    services => {'main': {'apertium': {'usernames': [{'name': 'apertium'}, {'name': 'apertium-deploy'}]}, 'api-gateway': {'usernames': [{'name': 'api-gateway'}, {'name': 'api-gateway-deploy'}]}, 'benthos-cache-invalidator': {'usernames': [{'name': 'benthos-cache-invalidator'}, {'name': 'benthos-cache-invalidator-deploy'}]}, 'changeprop': {'usernames': [{'name': 'changeprop'}, {'name': 'changeprop-deploy'}]}, 'changeprop-jobqueue': {'usernames': [{'name': 'changeprop-jobqueue'}, {'name': 'changeprop-jobqueue-deploy'}]}, 'chart-renderer': {'usernames': [{'name': 'chart-renderer'}, {'name': 'chart-renderer-deploy'}]}, 'cirrus-streaming-updater': {'usernames': [{'name': 'cirrus-streaming-updater'}, {'name': 'cirrus-streaming-updater-deploy'}]}, 'citoid': {'usernames': [{'name': 'citoid'}, {'name': 'citoid-deploy'}]}, 'commons-impact-analytics': {'usernames': [{'name': 'commons-impact-analytics'}, {'name': 'commons-impact-analytics-deploy'}]}, 'cxserver': {'usernames': [{'name': 'cxserver'}, {'name': 'cxserver-deploy'}]}, 'data-gateway': {'usernames': [{'name': 'data-gateway'}, {'name': 'data-gateway-deploy'}]}, 'developer-portal': {'usernames': [{'name': 'developer-portal'}, {'name': 'developer-portal-deploy'}]}, 'device-analytics': {'usernames': [{'name': 'device-analytics'}, {'name': 'device-analytics-deploy'}]}, 'echostore': {'usernames': [{'name': 'echostore'}, {'name': 'echostore-deploy'}]}, 'edit-analytics': {'usernames': [{'name': 'edit-analytics'}, {'name': 'edit-analytics-deploy'}]}, 'editor-analytics': {'usernames': [{'name': 'editor-analytics'}, {'name': 'editor-analytics-deploy'}]}, 'eventgate-analytics': {'usernames': [{'name': 'eventgate-analytics'}, {'name': 'eventgate-analytics-deploy'}]}, 'eventgate-analytics-external': {'usernames': [{'name': 'eventgate-analytics-external'}, {'name': 'eventgate-analytics-external-deploy'}]}, 'eventgate-logging-external': {'usernames': [{'name': 'eventgate-logging-external'}, {'name': 'eventgate-logging-external-deploy'}]}, 'eventgate-main': {'usernames': [{'name': 'eventgate-main'}, {'name': 'eventgate-main-deploy'}]}, 'eventstreams': {'usernames': [{'name': 'eventstreams'}, {'name': 'eventstreams-deploy'}]}, 'failoid-ng': {'usernames': [{'name': 'failoid-ng'}, {'name': 'failoid-ng-deploy'}]}, 'geo-analytics': {'usernames': [{'name': 'geo-analytics'}, {'name': 'geo-analytics-deploy'}]}, 'ipoid': {'usernames': [{'name': 'ipoid'}, {'name': 'ipoid-deploy'}]}, 'kartotherian': {'usernames': [{'name': 'kartotherian'}, {'name': 'kartotherian-deploy'}]}, 'linked-artifacts': {'usernames': [{'name': 'linked-artifacts'}, {'name': 'linked-artifacts-deploy'}]}, 'linkrecommendation': {'usernames': [{'name': 'linkrecommendation'}, {'name': 'linkrecommendation-deploy'}]}, 'machinetranslation': {'usernames': [{'name': 'machinetranslation'}, {'name': 'machinetranslation-deploy'}]}, 'mathoid': {'usernames': [{'name': 'mathoid'}, {'name': 'mathoid-deploy'}]}, 'media-analytics': {'usernames': [{'name': 'media-analytics'}, {'name': 'media-analytics-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'mobileapps': {'usernames': [{'name': 'mobileapps'}, {'name': 'mobileapps-deploy'}]}, 'mw-api-ext': {'usernames': [{'name': 'mw-api-ext'}, {'name': 'mw-api-ext-deploy'}]}, 'mw-api-int': {'usernames': [{'name': 'mw-api-int'}, {'name': 'mw-api-int-deploy'}]}, 'mw-cron': {'usernames': [{'name': 'mw-cron'}, {'name': 'mw-cron-deploy'}, {'group': 'restricted', 'name': 'mw-cron-restricted'}, {'group': 'restricted', 'name': 'mw-cron-restricted-deploy'}]}, 'mw-debug': {'usernames': [{'name': 'mw-debug'}, {'name': 'mw-debug-deploy'}]}, 'mw-experimental': {'usernames': [{'name': 'mw-experimental'}, {'name': 'mw-experimental-deploy'}]}, 'mw-jobrunner': {'usernames': [{'name': 'mw-jobrunner'}, {'name': 'mw-jobrunner-deploy'}]}, 'mw-mcrouter': {'usernames': [{'name': 'mw-mcrouter'}, {'name': 'mw-mcrouter-deploy'}]}, 'mw-misc': {'usernames': [{'name': 'mw-misc'}, {'name': 'mw-misc-deploy'}]}, 'mw-page-content-change-enrich': {'usernames': [{'name': 'mw-page-content-change-enrich'}, {'name': 'mw-page-content-change-enrich-deploy'}]}, 'mw-parsoid': {'usernames': [{'name': 'mw-parsoid'}, {'name': 'mw-parsoid-deploy'}]}, 'mw-script': {'usernames': [{'name': 'mw-script'}, {'name': 'mw-script-deploy'}, {'group': 'restricted', 'name': 'mw-script-restricted'}, {'group': 'restricted', 'name': 'mw-script-restricted-deploy'}]}, 'mw-videoscaler': {'usernames': [{'name': 'mw-videoscaler'}, {'name': 'mw-videoscaler-deploy'}]}, 'mw-web': {'usernames': [{'name': 'mw-web'}, {'name': 'mw-web-deploy'}]}, 'mw-wikifunctions': {'usernames': [{'name': 'mw-wikifunctions'}, {'name': 'mw-wikifunctions-deploy'}]}, 'opentelemetry-collector': {'usernames': [{'name': 'opentelemetry-collector'}, {'name': 'opentelemetry-collector-deploy'}]}, 'page-analytics': {'usernames': [{'name': 'page-analytics'}, {'name': 'page-analytics-deploy'}]}, 'proton': {'usernames': [{'name': 'proton'}, {'name': 'proton-deploy'}]}, 'push-notifications': {'usernames': [{'name': 'push-notifications'}, {'name': 'push-notifications-deploy'}]}, 'ratelimit': {'usernames': [{'name': 'ratelimit'}, {'name': 'ratelimit-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'recommendation-api': {'usernames': [{'name': 'recommendation-api'}, {'name': 'recommendation-api-deploy'}]}, 'rest-gateway': {'usernames': [{'name': 'rest-gateway'}, {'name': 'rest-gateway-deploy'}]}, 'sessionstore': {'usernames': [{'name': 'sessionstore'}, {'name': 'sessionstore-deploy'}]}, 'shellbox': {'usernames': [{'name': 'shellbox'}, {'name': 'shellbox-deploy'}]}, 'shellbox-constraints': {'usernames': [{'name': 'shellbox-constraints'}, {'name': 'shellbox-constraints-deploy'}]}, 'shellbox-media': {'usernames': [{'name': 'shellbox-media'}, {'name': 'shellbox-media-deploy'}]}, 'shellbox-syntaxhighlight': {'usernames': [{'name': 'shellbox-syntaxhighlight'}, {'name': 'shellbox-syntaxhighlight-deploy'}]}, 'shellbox-timeline': {'usernames': [{'name': 'shellbox-timeline'}, {'name': 'shellbox-timeline-deploy'}]}, 'shellbox-video': {'usernames': [{'name': 'shellbox-video'}, {'name': 'shellbox-video-deploy'}]}, 'tegola-vector-tiles': {'usernames': [{'name': 'tegola-vector-tiles'}, {'name': 'tegola-vector-tiles-deploy'}]}, 'termbox': {'usernames': [{'name': 'termbox'}, {'name': 'termbox-deploy'}]}, 'thumbor': {'usernames': [{'name': 'thumbor'}, {'name': 'thumbor-deploy'}]}, 'toolhub': {'usernames': [{'name': 'toolhub'}, {'name': 'toolhub-deploy'}]}, 'wikidata-query-gui': {'usernames': [{'name': 'wikidata-query-gui'}, {'name': 'wikidata-query-gui-deploy'}]}, 'wikifeeds': {'usernames': [{'name': 'wikifeeds'}, {'name': 'wikifeeds-deploy'}]}, 'wikifunctions': {'usernames': [{'name': 'wikifunctions'}, {'name': 'wikifunctions-deploy'}]}, 'zotero': {'usernames': [{'name': 'zotero'}, {'name': 'zotero-deploy'}]}}, 'ml-serve': {'article-descriptions': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-descriptions', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-descriptions-deploy', 'owner': 'root'}]}, 'article-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-models-deploy', 'owner': 'root'}]}, 'articletopic-outlink': {'usernames': [{'group': 'deploy-ml-service', 'name': 'articletopic-outlink', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'articletopic-outlink-deploy', 'owner': 'root'}]}, 'edit-check': {'usernames': [{'group': 'deploy-ml-service', 'name': 'edit-check', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'edit-check-deploy', 'owner': 'root'}]}, 'experimental': {'usernames': [{'group': 'deploy-ml-service', 'name': 'experimental', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-deploy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-debug', 'owner': 'root'}]}, 'llm': {'usernames': [{'group': 'deploy-ml-service', 'name': 'llm', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'llm-deploy', 'owner': 'root'}]}, 'logo-detection': {'usernames': [{'group': 'deploy-ml-service', 'name': 'logo-detection', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'logo-detection-deploy', 'owner': 'root'}]}, 'ores-legacy': {'usernames': [{'group': 'deploy-ml-service', 'name': 'ores-legacy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'ores-legacy-deploy', 'owner': 'root'}]}, 'readability': {'usernames': [{'group': 'deploy-ml-service', 'name': 'readability', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'readability-deploy', 'owner': 'root'}]}, 'recommendation-api-ng': {'usernames': [{'group': 'deploy-ml-service', 'name': 'recommendation-api-ng', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'recommendation-api-ng-deploy', 'owner': 'root'}]}, 'revertrisk': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revertrisk', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revertrisk-deploy', 'owner': 'root'}]}, 'revise-tone-task-generator': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator-deploy', 'owner': 'root'}]}, 'revision-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revision-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revision-models-deploy', 'owner': 'root'}]}, 'revscoring-articlequality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articlequality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articlequality-deploy', 'owner': 'root'}]}, 'revscoring-articletopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articletopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articletopic-deploy', 'owner': 'root'}]}, 'revscoring-draftquality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-draftquality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-draftquality-deploy', 'owner': 'root'}]}, 'revscoring-drafttopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic-deploy', 'owner': 'root'}]}, 'revscoring-editquality-damaging': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging-deploy', 'owner': 'root'}]}, 'revscoring-editquality-goodfaith': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith-deploy', 'owner': 'root'}]}, 'revscoring-editquality-reverted': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted-deploy', 'owner': 'root'}]}}, 'dse-k8s': {'analytics': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-deploy', 'owner': 'root'}]}, 'analytics-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-test-deploy', 'owner': 'root'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'kafka-ui': {'usernames': [{'name': 'kafka-ui'}, {'name': 'kafka-ui-deploy'}]}, 'opensearch-ipoid': {'usernames': [{'name': 'opensearch-ipoid'}, {'name': 'opensearch-ipoid-deploy'}]}, 'opensearch-ipoid-test': {'usernames': [{'name': 'opensearch-ipoid-test'}, {'name': 'opensearch-ipoid-test-deploy'}]}, 'opensearch-operator': {'usernames': [{'name': 'opensearch-operator'}, {'name': 'opensearch-operator-deploy'}]}, 'opensearch-operator-3': {'usernames': [{'name': 'opensearch-operator-3'}, {'name': 'opensearch-operator-3-deploy'}]}, 'opensearch-semantic-search': {'usernames': [{'name': 'opensearch-semantic-search'}, {'name': 'opensearch-semantic-search-deploy'}]}, 'opensearch-semantic-search-test': {'usernames': [{'name': 'opensearch-semantic-search-test'}, {'name': 'opensearch-semantic-search-test-deploy'}]}, 'opensearch-test': {'usernames': [{'name': 'opensearch-test'}, {'name': 'opensearch-test-deploy'}]}, 'opensearch-toolhub': {'usernames': [{'name': 'opensearch-toolhub'}, {'name': 'opensearch-toolhub-deploy'}]}, 'opensearch-toolhub-test': {'usernames': [{'name': 'opensearch-toolhub-test'}, {'name': 'opensearch-toolhub-test-deploy'}]}, 'opensearch-apifeatureusage': {'usernames': [{'name': 'opensearch-apifeatureusage'}, {'name': 'opensearch-apifeatureusage-deploy'}]}, 'opensearch-apifeatureusage-test': {'usernames': [{'name': 'opensearch-apifeatureusage-test'}, {'name': 'opensearch-apifeatureusage-test-deploy'}]}, 'opensearch-ttmserver': {'usernames': [{'name': 'opensearch-ttmserver'}, {'name': 'opensearch-ttmserver-deploy'}]}, 'opensearch-ttmserver-test': {'usernames': [{'name': 'opensearch-ttmserver-test'}, {'name': 'opensearch-ttmserver-test-deploy'}]}, 'wdqs': {'usernames': [{'name': 'wdqs'}, {'name': 'wdqs-deploy'}]}, 'wdqs-next': {'usernames': [{'name': 'wdqs-next'}, {'name': 'wdqs-next-deploy'}]}}, 'dse-k8s-codfw': {'echoserver': {'usernames': [{'name': 'echoserver'}, {'name': 'echoserver-deploy'}]}}, 'dse-k8s-eqiad': {'airflow-analytics-product': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-product', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-product-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product-deploy', 'owner': 'root'}]}, 'airflow-analytics-test': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-test', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-test-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test-deploy', 'owner': 'root'}]}, 'airflow-dev': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-dev', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-dev-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev-deploy', 'owner': 'root'}]}, 'airflow-fr-tech': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-fr-tech', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-fr-tech-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech-deploy', 'owner': 'root'}]}, 'airflow-main': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-main', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-main-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main-deploy', 'owner': 'root'}]}, 'airflow-ml': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-ml', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-ml-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml-deploy', 'owner': 'root'}]}, 'airflow-platform-eng': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-platform-eng', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-platform-eng-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng-deploy', 'owner': 'root'}]}, 'airflow-research': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-research', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-research-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research-deploy', 'owner': 'root'}]}, 'airflow-search': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-search', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-search-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search-deploy', 'owner': 'root'}]}, 'airflow-sre': {'private_files': {'group': 'ops', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-sre', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-sre-deploy', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre-deploy', 'owner': 'root'}]}, 'airflow-test-k8s': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-test-k8s', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-test-k8s-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s-deploy', 'owner': 'root'}]}, 'airflow-wikidata': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wikidata', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wikidata-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata-deploy', 'owner': 'root'}]}, 'airflow-wmde': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wmde', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wmde-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde-deploy', 'owner': 'root'}]}, 'blunderbuss': {'usernames': [{'name': 'blunderbuss'}, {'name': 'blunderbuss-deploy'}]}, 'datahub': {'usernames': [{'name': 'datahub'}, {'name': 'datahub-deploy'}]}, 'datahub-next': {'usernames': [{'name': 'datahub-next'}, {'name': 'datahub-next-deploy'}]}, 'datasets-config': {'usernames': [{'name': 'datasets-config'}, {'name': 'datasets-config-deploy'}]}, 'datasets-config-next': {'usernames': [{'name': 'datasets-config-next'}, {'name': 'datasets-config-next-deploy'}]}, 'eventstreams-internal': {'usernames': [{'name': 'eventstreams-internal'}, {'name': 'eventstreams-internal-deploy'}]}, 'growthbook': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-deploy', 'owner': 'root'}, {'name': 'growthbook'}, {'name': 'growthbook-deploy'}]}, 'growthbook-next': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook-next', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-next-deploy', 'owner': 'root'}, {'name': 'growthbook-next'}, {'name': 'growthbook-next-deploy'}]}, 'llm-inference': {'usernames': [{'group': 'research-deployers', 'name': 'llm-inference', 'owner': 'root'}, {'group': 'research-deployers', 'name': 'llm-inference-deploy', 'owner': 'root'}]}, 'mediawiki-dumps-legacy': {'usernames': [{'name': 'mediawiki-dumps-legacy'}, {'name': 'mediawiki-dumps-legacy-deploy'}]}, 'mw-content-history-reconcile-enrich': {'usernames': [{'name': 'mw-content-history-reconcile-enrich'}, {'name': 'mw-content-history-reconcile-enrich-deploy'}]}, 'mw-content-history-reconcile-enrich-next': {'usernames': [{'name': 'mw-content-history-reconcile-enrich-next'}, {'name': 'mw-content-history-reconcile-enrich-next-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich'}, {'name': 'mw-dump-rev-content-reconcile-enrich-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich-next': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich-next'}, {'name': 'mw-dump-rev-content-reconcile-enrich-next-deploy'}]}, 'mw-page-html-content-change-enrich': {'usernames': [{'name': 'mw-page-html-content-change-enrich'}, {'name': 'mw-page-html-content-change-enrich-deploy'}]}, 'mw-page-html-content-change-enrich-next': {'usernames': [{'name': 'mw-page-html-content-change-enrich-next'}, {'name': 'mw-page-html-content-change-enrich-next-deploy'}]}, 'mw-page-html-feature-counts-change-enrich': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich'}, {'name': 'mw-page-html-feature-counts-change-enrich-deploy'}]}, 'mw-page-html-feature-counts-change-enrich-next': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich-next'}, {'name': 'mw-page-html-feature-counts-change-enrich-next-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'spark': {'usernames': [{'name': 'spark'}, {'name': 'spark-deploy'}]}, 'spark-history': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-deploy', 'owner': 'root'}]}, 'spark-history-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-test-deploy', 'owner': 'root'}]}, 'superset': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-deploy', 'owner': 'root'}]}, 'superset-next': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset-next', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-next-deploy', 'owner': 'root'}]}, 'test-kitchen': {'usernames': [{'name': 'test-kitchen'}, {'name': 'test-kitchen-deploy'}]}, 'test-kitchen-next': {'usernames': [{'name': 'test-kitchen-next'}, {'name': 'test-kitchen-next-deploy'}]}, 'turnilo': {'usernames': [{'name': 'turnilo'}, {'name': 'turnilo-deploy'}]}, 'turnilo-next': {'usernames': [{'name': 'turnilo-next'}, {'name': 'turnilo-next-deploy'}]}, 'webrequest-page-view': {'usernames': [{'name': 'webrequest-page-view'}, {'name': 'webrequest-page-view-deploy'}]}, 'webrequest-page-view-next': {'usernames': [{'name': 'webrequest-page-view-next'}, {'name': 'webrequest-page-view-next-deploy'}]}, 'wdqs-queryhammer': {'usernames': [{'name': 'wdqs-queryhammer'}, {'name': 'wdqs-queryhammer-deploy'}]}}, 'aux-k8s': {'codesearch': {'usernames': [{'name': 'codesearch'}, {'name': 'codesearch-deploy'}]}, 'jaeger': {'usernames': [{'name': 'jaeger'}, {'name': 'jaeger-deploy'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'redioscope': {'usernames': [{'name': 'redioscope'}, {'name': 'redioscope-deploy'}]}, 'sophroid': {'usernames': [{'name': 'sophroid'}, {'name': 'sophroid-deploy'}]}, 'zarcillo': {'usernames': [{'name': 'zarcillo'}, {'name': 'zarcillo-deploy'}]}}}
  

• Exec[Generate cert dse__wdqs-next refresh]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-next refresh].orig
  +++ Exec[Generate cert dse__wdqs-next refresh]
  
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-next.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-next
  
  +    refreshonly => True
  +    subscribe   => File[/etc/cfssl/csr/dse__wdqs-next.csr]
  +    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/cfssl/csr/dse__wdqs-external-next-deploy.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/dse__wdqs-external-next-deploy.csr].orig
  +++ File[/etc/cfssl/csr/dse__wdqs-external-next-deploy.csr]
  
  -    mode   => 0400
  -    owner  => root
  -    group  => root
  -    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/dse__wdqs-external-next-deploy.csr.orig
  +++ /etc/cfssl/csr/dse__wdqs-external-next-deploy.csr
  @@ -1,26 +0,0 @@
  -{
  -  "CN": "wdqs-external-next-deploy",
  -  "hosts": [
  -    "wdqs-external-next-deploy"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -    {
  -      "C": null,
  -      "L": null,
  -      "O": "view",
  -      "OU": null,
  -      "S": null
  -    },
  -    {
  -      "C": null,
  -      "L": null,
  -      "O": "deploy",
  -      "OU": null,
  -      "S": null
  -    }
  -  ]
  -}

• Cfssl::Cert[dse__wdqs-external]

  Parameters differences:

  --- Cfssl::Cert[dse__wdqs-external].orig
  +++ Cfssl::Cert[dse__wdqs-external]
  
  -    notify_services => []
  -    renew_seconds   => 952200
  -    names           => [{'organisation': 'view'}]
  -    key             => {'algo': 'ecdsa', 'size': 256}
  -    auto_renew      => True
  -    owner           => mwdeploy
  -    provide_chain   => True
  -    mode            => 0740
  -    common_name     => wdqs-external
  -    label           => dse
  -    ensure          => present
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    group           => deployment
  -    outdir          => /etc/kubernetes/pki
  -    before_services => []
  -    hosts           => []
  

• Exec[Generate cert dse__wdqs refresh]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs refresh].orig
  +++ Exec[Generate cert dse__wdqs refresh]
  
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs
  
  +    refreshonly => True
  +    subscribe   => File[/etc/cfssl/csr/dse__wdqs.csr]
  +    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/kubernetes/wdqs-internal-next-dse-k8s-codfw.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-internal-next-dse-k8s-codfw.config].orig
  +++ File[/etc/kubernetes/wdqs-internal-next-dse-k8s-codfw.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-internal-next-dse-k8s-codfw.config.orig
  +++ /etc/kubernetes/wdqs-internal-next-dse-k8s-codfw.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-internal-next
  -    namespace: wdqs-internal-next
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
  -users:
  -- name: wdqs-internal-next
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-internal-next.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-internal-next-key.pem

• File[/etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem]
  
  -    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
  -    owner  => mwdeploy
  -    mode   => 0440
  -    group  => deployment
  -    ensure => file
  

• File[/etc/kubernetes/pki/dse__wdqs-next.chain.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-next.chain.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-next.chain.pem]
  
  +    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
  +    owner  => mwdeploy
  +    mode   => 0440
  +    group  => deployment
  +    ensure => file
  

• File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.csr]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.csr].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.csr]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• File[/etc/kubernetes/pki/dse__wdqs-next-deploy.chained.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-next-deploy.chained.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-next-deploy.chained.pem]
  
  +    owner   => mwdeploy
  +    require => Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem]
  +    group   => deployment
  +    ensure  => file
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-codfw.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-codfw.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-codfw.config]
  
  -    master_host => dse-k8s-ctrl.svc.codfw.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-internal
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-internal-deploy
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-internal-deploy.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-internal-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-internal-deploy.chained.pem'}
  -    group       => deployment
  

• Cfssl::Cert[dse__wdqs-external-next-deploy]

  Parameters differences:

  --- Cfssl::Cert[dse__wdqs-external-next-deploy].orig
  +++ Cfssl::Cert[dse__wdqs-external-next-deploy]
  
  -    notify_services => []
  -    renew_seconds   => 952200
  -    names           => [{'organisation': 'view'}, {'organisation': 'deploy'}]
  -    key             => {'algo': 'ecdsa', 'size': 256}
  -    auto_renew      => True
  -    owner           => mwdeploy
  -    provide_chain   => True
  -    mode            => 0740
  -    common_name     => wdqs-external-next-deploy
  -    label           => dse
  -    ensure          => present
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    group           => deployment
  -    outdir          => /etc/kubernetes/pki
  -    before_services => []
  -    hosts           => []
  

• Exec[Generate cert dse__wdqs-internal refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-internal refresh on intermediate ca change].orig
  +++ Exec[Generate cert dse__wdqs-internal refresh on intermediate ca change]
  
  -    refreshonly => True
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-internal.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal
  
  -    subscribe   => File[/etc/kubernetes/pki/dse__wdqs-internal.chain.pem]
  

• File[/etc/kubernetes/pki/dse__wdqs-external.chained.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external.chained.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external.chained.pem]
  
  -    owner   => mwdeploy
  -    require => Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external.chain.pem]
  -    group   => deployment
  -    ensure  => file
  

• File[/etc/kubernetes/wdqs-next-deploy-dse-k8s-codfw.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-next-deploy-dse-k8s-codfw.config].orig
  +++ File[/etc/kubernetes/wdqs-next-deploy-dse-k8s-codfw.config]
  
  +    mode   => 0640
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-next-deploy-dse-k8s-codfw.config.orig
  +++ /etc/kubernetes/wdqs-next-deploy-dse-k8s-codfw.config
  @@ -0,0 +1,19 @@
  +apiVersion: v1
  +kind: Config
  +preferences: {}
  +current-context: default-system
  +contexts:
  +- name: default-system
  +  context:
  +    cluster: default-cluster
  +    user: wdqs-next-deploy
  +    namespace: wdqs-next
  +clusters:
  +- name: default-cluster
  +  cluster:
  +    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
  +users:
  +- name: wdqs-next-deploy
  +  user:
  +    client-certificate: /etc/kubernetes/pki/dse__wdqs-next-deploy.pem
  +    client-key: /etc/kubernetes/pki/dse__wdqs-next-deploy-key.pem

• Exec[Generate cert dse__wdqs-internal refresh]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-internal refresh].orig
  +++ Exec[Generate cert dse__wdqs-internal refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-internal.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal
  
  -    refreshonly => True
  -    subscribe   => File[/etc/cfssl/csr/dse__wdqs-internal.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-dse-k8s-codfw.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-dse-k8s-codfw.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-dse-k8s-codfw.config]
  
  -    master_host => dse-k8s-ctrl.svc.codfw.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-external-next
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-external-next
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-external-next.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-external-next-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-external-next.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-external-next.chained.pem'}
  -    group       => deployment
  

• File[/etc/kubernetes/pki/dse__wdqs-deploy.csr]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-deploy.csr].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-deploy.csr]
  
  +    mode   => 0440
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => file
  

• File[/etc/kubernetes/wdqs-next-dse-k8s-codfw.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-next-dse-k8s-codfw.config].orig
  +++ File[/etc/kubernetes/wdqs-next-dse-k8s-codfw.config]
  
  +    mode   => 0640
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-next-dse-k8s-codfw.config.orig
  +++ /etc/kubernetes/wdqs-next-dse-k8s-codfw.config
  @@ -0,0 +1,19 @@
  +apiVersion: v1
  +kind: Config
  +preferences: {}
  +current-context: default-system
  +contexts:
  +- name: default-system
  +  context:
  +    cluster: default-cluster
  +    user: wdqs-next
  +    namespace: wdqs-next
  +clusters:
  +- name: default-cluster
  +  cluster:
  +    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
  +users:
  +- name: wdqs-next
  +  user:
  +    client-certificate: /etc/kubernetes/pki/dse__wdqs-next.pem
  +    client-key: /etc/kubernetes/pki/dse__wdqs-next-key.pem

• Exec[Generate cert dse__wdqs-internal-next]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-internal-next].orig
  +++ Exec[Generate cert dse__wdqs-internal-next]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-internal-next.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal-next
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-internal-next.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__wdqs-internal-next-key.pem 2>&1)"
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-next.csr]
  

• File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chained.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chained.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chained.pem]
  
  -    owner   => mwdeploy
  -    require => Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem]
  -    group   => deployment
  -    ensure  => file
  

• Exec[renew certificate - dse__wdqs-deploy]

  Parameters differences:

  --- Exec[renew certificate - dse__wdqs-deploy].orig
  +++ Exec[renew certificate - dse__wdqs-deploy]
  
  +    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__wdqs-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-deploy
  
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-deploy.pem -checkend 952200
  +    require     => Exec[Generate cert dse__wdqs-deploy]
  

• File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.pem]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• Exec[Generate cert dse__wdqs-external-next refresh]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-external-next refresh].orig
  +++ Exec[Generate cert dse__wdqs-external-next refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-external-next.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external-next
  
  -    refreshonly => True
  -    subscribe   => File[/etc/cfssl/csr/dse__wdqs-external-next.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/kubernetes/pki/dse__wdqs-internal.chain.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal.chain.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal.chain.pem]
  
  -    source => puppet:///modules/profile/pki/intermediates/dse-cert.pem
  -    owner  => mwdeploy
  -    mode   => 0440
  -    group  => deployment
  -    ensure => file
  

• File[/etc/cfssl/csr/dse__wdqs-external-deploy.csr]

  Parameters differences:

  --- File[/etc/cfssl/csr/dse__wdqs-external-deploy.csr].orig
  +++ File[/etc/cfssl/csr/dse__wdqs-external-deploy.csr]
  
  -    mode   => 0400
  -    owner  => root
  -    group  => root
  -    ensure => file
  

  Content differences:

  --- /etc/cfssl/csr/dse__wdqs-external-deploy.csr.orig
  +++ /etc/cfssl/csr/dse__wdqs-external-deploy.csr
  @@ -1,26 +0,0 @@
  -{
  -  "CN": "wdqs-external-deploy",
  -  "hosts": [
  -    "wdqs-external-deploy"
  -  ],
  -  "key": {
  -    "algo": "ecdsa",
  -    "size": 256
  -  },
  -  "names": [
  -    {
  -      "C": null,
  -      "L": null,
  -      "O": "view",
  -      "OU": null,
  -      "S": null
  -    },
  -    {
  -      "C": null,
  -      "L": null,
  -      "O": "deploy",
  -      "OU": null,
  -      "S": null
  -    }
  -  ]
  -}

• File[/etc/kubernetes/wdqs-external-dse-k8s-eqiad.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-external-dse-k8s-eqiad.config].orig
  +++ File[/etc/kubernetes/wdqs-external-dse-k8s-eqiad.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-external-dse-k8s-eqiad.config.orig
  +++ /etc/kubernetes/wdqs-external-dse-k8s-eqiad.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-external
  -    namespace: wdqs-external
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
  -users:
  -- name: wdqs-external
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-external.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-external-key.pem

• File[/etc/kubernetes/pki/dse__wdqs-internal-next.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-next.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-next.pem]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• Exec[Generate cert dse__wdqs-external-next-deploy refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-external-next-deploy refresh on intermediate ca change].orig
  +++ Exec[Generate cert dse__wdqs-external-next-deploy refresh on intermediate ca change]
  
  -    refreshonly => True
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-next-deploy.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-external-next-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external-next-deploy
  
  -    subscribe   => File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem]
  

• File[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-eqiad.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-eqiad.config].orig
  +++ File[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-eqiad.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-eqiad.config.orig
  +++ /etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-eqiad.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-internal-next-deploy
  -    namespace: wdqs-internal-next
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.eqiad.wmnet:6443
  -users:
  -- name: wdqs-internal-next-deploy
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-internal-next-deploy-key.pem

• File[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-codfw.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-codfw.config].orig
  +++ File[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-codfw.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-codfw.config.orig
  +++ /etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-codfw.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-internal-next-deploy
  -    namespace: wdqs-internal-next
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
  -users:
  -- name: wdqs-internal-next-deploy
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-internal-next-deploy-key.pem

• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-deploy-dse-k8s-codfw.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-external-deploy-dse-k8s-codfw.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-external-deploy-dse-k8s-codfw.config]
  
  -    master_host => dse-k8s-ctrl.svc.codfw.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-external
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-external-deploy
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-external-deploy.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-external-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-external-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-external-deploy.chained.pem'}
  -    group       => deployment
  

• Exec[renew certificate - dse__wdqs-internal-next]

  Parameters differences:

  --- Exec[renew certificate - dse__wdqs-internal-next].orig
  +++ Exec[renew certificate - dse__wdqs-internal-next]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__wdqs-internal-next.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal-next
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-internal-next.pem -checkend 952200
  -    require     => Exec[Generate cert dse__wdqs-internal-next]
  

• Exec[Generate cert dse__wdqs-internal-deploy refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-internal-deploy refresh on intermediate ca change].orig
  +++ Exec[Generate cert dse__wdqs-internal-deploy refresh on intermediate ca change]
  
  -    refreshonly => True
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal-deploy.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-internal-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal-deploy
  
  -    subscribe   => File[/etc/kubernetes/pki/dse__wdqs-internal-deploy.chain.pem]
  

• Exec[Generate cert dse__wdqs-next refresh on intermediate ca change]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-next refresh on intermediate ca change].orig
  +++ Exec[Generate cert dse__wdqs-next refresh on intermediate ca change]
  
  +    refreshonly => True
  +    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-next.csr]
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-next.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-next
  
  +    subscribe   => File[/etc/kubernetes/pki/dse__wdqs-next.chain.pem]
  

• File[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-codfw.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-codfw.config].orig
  +++ File[/etc/kubernetes/wdqs-internal-deploy-dse-k8s-codfw.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-internal-deploy-dse-k8s-codfw.config.orig
  +++ /etc/kubernetes/wdqs-internal-deploy-dse-k8s-codfw.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-internal-deploy
  -    namespace: wdqs-internal
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
  -users:
  -- name: wdqs-internal-deploy
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-internal-deploy.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-internal-deploy-key.pem

• K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-eqiad.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-eqiad.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-eqiad.config]
  
  -    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-external-next
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-external-next-deploy
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-external-next-deploy.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-external-next-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chained.pem'}
  -    group       => deployment
  

• Cfssl::Cert[dse__wdqs-internal-deploy]

  Parameters differences:

  --- Cfssl::Cert[dse__wdqs-internal-deploy].orig
  +++ Cfssl::Cert[dse__wdqs-internal-deploy]
  
  -    notify_services => []
  -    renew_seconds   => 952200
  -    names           => [{'organisation': 'view'}, {'organisation': 'deploy'}]
  -    key             => {'algo': 'ecdsa', 'size': 256}
  -    auto_renew      => True
  -    owner           => mwdeploy
  -    provide_chain   => True
  -    mode            => 0740
  -    common_name     => wdqs-internal-deploy
  -    label           => dse
  -    ensure          => present
  -    environment     => ['GODEBUG=x509ignoreCN=0']
  -    group           => deployment
  -    outdir          => /etc/kubernetes/pki
  -    before_services => []
  -    hosts           => []
  

• File[/etc/kubernetes/pki/dse__wdqs-external-key.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-key.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-key.pem]
  
  -    show_diff => False
  -    owner     => mwdeploy
  -    mode      => 0440
  -    backup    => False
  -    group     => deployment
  -    ensure    => file
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-next-deploy-dse-k8s-codfw.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-next-deploy-dse-k8s-codfw.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-next-deploy-dse-k8s-codfw.config]
  
  +    master_host => dse-k8s-ctrl.svc.codfw.wmnet
  +    require     => ['Class[K8s::Base_dirs]']
  +    owner       => mwdeploy
  +    namespace   => wdqs-next
  +    mode        => 0640
  +    ensure      => present
  +    username    => wdqs-next-deploy
  +    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-next-deploy.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-next-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-next-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-next-deploy.chained.pem'}
  +    group       => deployment
  

• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem].orig
  +++ Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem]
  
  -    command   => /bin/cat /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.pem /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem > /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chained.pem
  -    subscribe => ['Exec[renew certificate - dse__wdqs-internal-next-deploy]', 'File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem]', 'File[/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.pem]']
  -    require   => Exec[Generate cert dse__wdqs-internal-next-deploy refresh on intermediate ca change]
  -    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.pem /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chained.pem | sha512sum)"
  
  

• File[/etc/kubernetes/pki/dse__wdqs-next.chained.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-next.chained.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-next.chained.pem]
  
  +    owner   => mwdeploy
  +    require => Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-next.chain.pem]
  +    group   => deployment
  +    ensure  => file
  

• Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-deploy.csr]

  Parameters differences:

  --- Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-deploy.csr].orig
  +++ Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-deploy.csr]
  
  -    key         => {'algo': 'ecdsa', 'size': 256}
  -    hosts       => []
  -    names       => [{'organisation': 'view'}, {'organisation': 'deploy'}]
  -    common_name => wdqs-external-deploy
  -    ensure      => present
  

• File[/etc/kubernetes/pki/dse__wdqs-external-deploy.csr]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external-deploy.csr].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external-deploy.csr]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-eqiad.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-eqiad.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-internal-next-deploy-dse-k8s-eqiad.config]
  
  -    master_host => dse-k8s-ctrl.svc.eqiad.wmnet
  -    require     => ['Class[K8s::Base_dirs]']
  -    owner       => mwdeploy
  -    namespace   => wdqs-internal-next
  -    mode        => 0640
  -    ensure      => present
  -    username    => wdqs-internal-next-deploy
  -    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-internal-next-deploy-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-internal-next-deploy.chained.pem'}
  -    group       => deployment
  

• File[/etc/kubernetes/pki/dse__wdqs-next.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-next.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-next.pem]
  
  +    mode   => 0440
  +    owner  => mwdeploy
  +    group  => deployment
  +    ensure => file
  

• Exec[Generate cert dse__wdqs-next-deploy]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-next-deploy].orig
  +++ Exec[Generate cert dse__wdqs-next-deploy]
  
  +    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-next-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-next-deploy
  
  +    environment => ['GODEBUG=x509ignoreCN=0']
  +    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-next-deploy.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__wdqs-next-deploy-key.pem 2>&1)"
  
  +    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-next-deploy.csr]
  

• Exec[renew certificate - dse__wdqs-external]

  Parameters differences:

  --- Exec[renew certificate - dse__wdqs-external].orig
  +++ Exec[renew certificate - dse__wdqs-external]
  
  -    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/kubernetes/pki/dse__wdqs-external.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-external.pem -checkend 952200
  -    require     => Exec[Generate cert dse__wdqs-external]
  

• Cfssl::Cert[dse__wdqs-next-deploy]

  Parameters differences:

  --- Cfssl::Cert[dse__wdqs-next-deploy].orig
  +++ Cfssl::Cert[dse__wdqs-next-deploy]
  
  +    notify_services => []
  +    renew_seconds   => 952200
  +    names           => [{'organisation': 'view'}, {'organisation': 'deploy'}]
  +    key             => {'algo': 'ecdsa', 'size': 256}
  +    auto_renew      => True
  +    owner           => mwdeploy
  +    provide_chain   => True
  +    mode            => 0740
  +    common_name     => wdqs-next-deploy
  +    label           => dse
  +    ensure          => present
  +    environment     => ['GODEBUG=x509ignoreCN=0']
  +    group           => deployment
  +    outdir          => /etc/kubernetes/pki
  +    before_services => []
  +    hosts           => []
  

• Exec[Generate cert dse__wdqs-external-next-deploy]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-external-next-deploy].orig
  +++ Exec[Generate cert dse__wdqs-external-next-deploy]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-external-next-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-external-next-deploy
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-external-next-deploy.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__wdqs-external-next-deploy-key.pem 2>&1)"
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-external-next-deploy.csr]
  

• File[/etc/kubernetes/wdqs-internal-dse-k8s-codfw.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-internal-dse-k8s-codfw.config].orig
  +++ File[/etc/kubernetes/wdqs-internal-dse-k8s-codfw.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-internal-dse-k8s-codfw.config.orig
  +++ /etc/kubernetes/wdqs-internal-dse-k8s-codfw.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-internal
  -    namespace: wdqs-internal
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
  -users:
  -- name: wdqs-internal
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-internal.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-internal-key.pem

• File[/etc/kubernetes/pki/dse__wdqs-external.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-external.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-external.pem]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• Exec[Generate cert dse__wdqs-internal]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-internal].orig
  +++ Exec[Generate cert dse__wdqs-internal]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-internal.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal
  
  -    environment => ['GODEBUG=x509ignoreCN=0']
  -    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/kubernetes/pki/dse__wdqs-internal.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/kubernetes/pki/dse__wdqs-internal-key.pem 2>&1)"
  
  -    require     => Cfssl::Csr[/etc/cfssl/csr/dse__wdqs-internal.csr]
  

• File[/etc/kubernetes/pki/dse__wdqs-internal-next-key.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal-next-key.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal-next-key.pem]
  
  -    show_diff => False
  -    owner     => mwdeploy
  -    mode      => 0440
  -    backup    => False
  -    group     => deployment
  -    ensure    => file
  

• Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem]

  Parameters differences:

  --- Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem].orig
  +++ Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem]
  
  -    command   => /bin/cat /etc/kubernetes/pki/dse__wdqs-external-next-deploy.pem /etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem > /etc/kubernetes/pki/dse__wdqs-external-next-deploy.chained.pem
  -    subscribe => ['Exec[renew certificate - dse__wdqs-external-next-deploy]', 'File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem]', 'File[/etc/kubernetes/pki/dse__wdqs-external-next-deploy.pem]']
  -    require   => Exec[Generate cert dse__wdqs-external-next-deploy refresh on intermediate ca change]
  -    unless    => /usr/bin/test "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-external-next-deploy.pem /etc/kubernetes/pki/dse__wdqs-external-next-deploy.chain.pem | sha512sum)" == "$(/bin/cat /etc/kubernetes/pki/dse__wdqs-external-next-deploy.chained.pem | sha512sum)"
  
  

• Exec[Generate cert dse__wdqs-internal-deploy refresh]

  Parameters differences:

  --- Exec[Generate cert dse__wdqs-internal-deploy refresh].orig
  +++ Exec[Generate cert dse__wdqs-internal-deploy refresh]
  
  -    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/deploy1003.eqiad.wmnet.pem -label dse  /etc/cfssl/csr/dse__wdqs-internal-deploy.csr | /usr/bin/cfssljson -bare /etc/kubernetes/pki/dse__wdqs-internal-deploy
  
  -    refreshonly => True
  -    subscribe   => File[/etc/cfssl/csr/dse__wdqs-internal-deploy.csr]
  -    environment => ['GODEBUG=x509ignoreCN=0']
  

• File[/etc/kubernetes/pki/dse__wdqs-deploy.chained.pem]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-deploy.chained.pem].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-deploy.chained.pem]
  
  +    owner   => mwdeploy
  +    require => Exec[create chained cert /etc/kubernetes/pki/dse__wdqs-deploy.chain.pem]
  +    group   => deployment
  +    ensure  => file
  

• File[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-codfw.config]

  Parameters differences:

  --- File[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-codfw.config].orig
  +++ File[/etc/kubernetes/wdqs-external-next-deploy-dse-k8s-codfw.config]
  
  -    mode   => 0640
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => present
  

  Content differences:

  --- /etc/kubernetes/wdqs-external-next-deploy-dse-k8s-codfw.config.orig
  +++ /etc/kubernetes/wdqs-external-next-deploy-dse-k8s-codfw.config
  @@ -1,19 +0,0 @@
  -apiVersion: v1
  -kind: Config
  -preferences: {}
  -current-context: default-system
  -contexts:
  -- name: default-system
  -  context:
  -    cluster: default-cluster
  -    user: wdqs-external-next-deploy
  -    namespace: wdqs-external-next
  -clusters:
  -- name: default-cluster
  -  cluster:
  -    server: https://dse-k8s-ctrl.svc.codfw.wmnet:6443
  -users:
  -- name: wdqs-external-next-deploy
  -  user:
  -    client-certificate: /etc/kubernetes/pki/dse__wdqs-external-next-deploy.pem
  -    client-key: /etc/kubernetes/pki/dse__wdqs-external-next-deploy-key.pem

• Class[Profile::Kubernetes::Deployment_server]

  Parameters differences:

  --- Class[Profile::Kubernetes::Deployment_server].orig
  +++ Class[Profile::Kubernetes::Deployment_server]
  
  @@
  -    services => {'main': {'apertium': {'usernames': [{'name': 'apertium'}, {'name': 'apertium-deploy'}]}, 'api-gateway': {'usernames': [{'name': 'api-gateway'}, {'name': 'api-gateway-deploy'}]}, 'benthos-cache-invalidator': {'usernames': [{'name': 'benthos-cache-invalidator'}, {'name': 'benthos-cache-invalidator-deploy'}]}, 'changeprop': {'usernames': [{'name': 'changeprop'}, {'name': 'changeprop-deploy'}]}, 'changeprop-jobqueue': {'usernames': [{'name': 'changeprop-jobqueue'}, {'name': 'changeprop-jobqueue-deploy'}]}, 'chart-renderer': {'usernames': [{'name': 'chart-renderer'}, {'name': 'chart-renderer-deploy'}]}, 'cirrus-streaming-updater': {'usernames': [{'name': 'cirrus-streaming-updater'}, {'name': 'cirrus-streaming-updater-deploy'}]}, 'citoid': {'usernames': [{'name': 'citoid'}, {'name': 'citoid-deploy'}]}, 'commons-impact-analytics': {'usernames': [{'name': 'commons-impact-analytics'}, {'name': 'commons-impact-analytics-deploy'}]}, 'cxserver': {'usernames': [{'name': 'cxserver'}, {'name': 'cxserver-deploy'}]}, 'data-gateway': {'usernames': [{'name': 'data-gateway'}, {'name': 'data-gateway-deploy'}]}, 'developer-portal': {'usernames': [{'name': 'developer-portal'}, {'name': 'developer-portal-deploy'}]}, 'device-analytics': {'usernames': [{'name': 'device-analytics'}, {'name': 'device-analytics-deploy'}]}, 'echostore': {'usernames': [{'name': 'echostore'}, {'name': 'echostore-deploy'}]}, 'edit-analytics': {'usernames': [{'name': 'edit-analytics'}, {'name': 'edit-analytics-deploy'}]}, 'editor-analytics': {'usernames': [{'name': 'editor-analytics'}, {'name': 'editor-analytics-deploy'}]}, 'eventgate-analytics': {'usernames': [{'name': 'eventgate-analytics'}, {'name': 'eventgate-analytics-deploy'}]}, 'eventgate-analytics-external': {'usernames': [{'name': 'eventgate-analytics-external'}, {'name': 'eventgate-analytics-external-deploy'}]}, 'eventgate-logging-external': {'usernames': [{'name': 'eventgate-logging-external'}, {'name': 'eventgate-logging-external-deploy'}]}, 'eventgate-main': {'usernames': [{'name': 'eventgate-main'}, {'name': 'eventgate-main-deploy'}]}, 'eventstreams': {'usernames': [{'name': 'eventstreams'}, {'name': 'eventstreams-deploy'}]}, 'failoid-ng': {'usernames': [{'name': 'failoid-ng'}, {'name': 'failoid-ng-deploy'}]}, 'geo-analytics': {'usernames': [{'name': 'geo-analytics'}, {'name': 'geo-analytics-deploy'}]}, 'ipoid': {'usernames': [{'name': 'ipoid'}, {'name': 'ipoid-deploy'}]}, 'kartotherian': {'usernames': [{'name': 'kartotherian'}, {'name': 'kartotherian-deploy'}]}, 'linked-artifacts': {'usernames': [{'name': 'linked-artifacts'}, {'name': 'linked-artifacts-deploy'}]}, 'linkrecommendation': {'usernames': [{'name': 'linkrecommendation'}, {'name': 'linkrecommendation-deploy'}]}, 'machinetranslation': {'usernames': [{'name': 'machinetranslation'}, {'name': 'machinetranslation-deploy'}]}, 'mathoid': {'usernames': [{'name': 'mathoid'}, {'name': 'mathoid-deploy'}]}, 'media-analytics': {'usernames': [{'name': 'media-analytics'}, {'name': 'media-analytics-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'mobileapps': {'usernames': [{'name': 'mobileapps'}, {'name': 'mobileapps-deploy'}]}, 'mw-api-ext': {'usernames': [{'name': 'mw-api-ext'}, {'name': 'mw-api-ext-deploy'}]}, 'mw-api-int': {'usernames': [{'name': 'mw-api-int'}, {'name': 'mw-api-int-deploy'}]}, 'mw-cron': {'usernames': [{'name': 'mw-cron'}, {'name': 'mw-cron-deploy'}, {'group': 'restricted', 'name': 'mw-cron-restricted'}, {'group': 'restricted', 'name': 'mw-cron-restricted-deploy'}]}, 'mw-debug': {'usernames': [{'name': 'mw-debug'}, {'name': 'mw-debug-deploy'}]}, 'mw-experimental': {'usernames': [{'name': 'mw-experimental'}, {'name': 'mw-experimental-deploy'}]}, 'mw-jobrunner': {'usernames': [{'name': 'mw-jobrunner'}, {'name': 'mw-jobrunner-deploy'}]}, 'mw-mcrouter': {'usernames': [{'name': 'mw-mcrouter'}, {'name': 'mw-mcrouter-deploy'}]}, 'mw-misc': {'usernames': [{'name': 'mw-misc'}, {'name': 'mw-misc-deploy'}]}, 'mw-page-content-change-enrich': {'usernames': [{'name': 'mw-page-content-change-enrich'}, {'name': 'mw-page-content-change-enrich-deploy'}]}, 'mw-parsoid': {'usernames': [{'name': 'mw-parsoid'}, {'name': 'mw-parsoid-deploy'}]}, 'mw-script': {'usernames': [{'name': 'mw-script'}, {'name': 'mw-script-deploy'}, {'group': 'restricted', 'name': 'mw-script-restricted'}, {'group': 'restricted', 'name': 'mw-script-restricted-deploy'}]}, 'mw-videoscaler': {'usernames': [{'name': 'mw-videoscaler'}, {'name': 'mw-videoscaler-deploy'}]}, 'mw-web': {'usernames': [{'name': 'mw-web'}, {'name': 'mw-web-deploy'}]}, 'mw-wikifunctions': {'usernames': [{'name': 'mw-wikifunctions'}, {'name': 'mw-wikifunctions-deploy'}]}, 'opentelemetry-collector': {'usernames': [{'name': 'opentelemetry-collector'}, {'name': 'opentelemetry-collector-deploy'}]}, 'page-analytics': {'usernames': [{'name': 'page-analytics'}, {'name': 'page-analytics-deploy'}]}, 'proton': {'usernames': [{'name': 'proton'}, {'name': 'proton-deploy'}]}, 'push-notifications': {'usernames': [{'name': 'push-notifications'}, {'name': 'push-notifications-deploy'}]}, 'ratelimit': {'usernames': [{'name': 'ratelimit'}, {'name': 'ratelimit-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'recommendation-api': {'usernames': [{'name': 'recommendation-api'}, {'name': 'recommendation-api-deploy'}]}, 'rest-gateway': {'usernames': [{'name': 'rest-gateway'}, {'name': 'rest-gateway-deploy'}]}, 'sessionstore': {'usernames': [{'name': 'sessionstore'}, {'name': 'sessionstore-deploy'}]}, 'shellbox': {'usernames': [{'name': 'shellbox'}, {'name': 'shellbox-deploy'}]}, 'shellbox-constraints': {'usernames': [{'name': 'shellbox-constraints'}, {'name': 'shellbox-constraints-deploy'}]}, 'shellbox-media': {'usernames': [{'name': 'shellbox-media'}, {'name': 'shellbox-media-deploy'}]}, 'shellbox-syntaxhighlight': {'usernames': [{'name': 'shellbox-syntaxhighlight'}, {'name': 'shellbox-syntaxhighlight-deploy'}]}, 'shellbox-timeline': {'usernames': [{'name': 'shellbox-timeline'}, {'name': 'shellbox-timeline-deploy'}]}, 'shellbox-video': {'usernames': [{'name': 'shellbox-video'}, {'name': 'shellbox-video-deploy'}]}, 'tegola-vector-tiles': {'usernames': [{'name': 'tegola-vector-tiles'}, {'name': 'tegola-vector-tiles-deploy'}]}, 'termbox': {'usernames': [{'name': 'termbox'}, {'name': 'termbox-deploy'}]}, 'thumbor': {'usernames': [{'name': 'thumbor'}, {'name': 'thumbor-deploy'}]}, 'toolhub': {'usernames': [{'name': 'toolhub'}, {'name': 'toolhub-deploy'}]}, 'wikidata-query-gui': {'usernames': [{'name': 'wikidata-query-gui'}, {'name': 'wikidata-query-gui-deploy'}]}, 'wikifeeds': {'usernames': [{'name': 'wikifeeds'}, {'name': 'wikifeeds-deploy'}]}, 'wikifunctions': {'usernames': [{'name': 'wikifunctions'}, {'name': 'wikifunctions-deploy'}]}, 'zotero': {'usernames': [{'name': 'zotero'}, {'name': 'zotero-deploy'}]}}, 'ml-serve': {'article-descriptions': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-descriptions', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-descriptions-deploy', 'owner': 'root'}]}, 'article-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-models-deploy', 'owner': 'root'}]}, 'articletopic-outlink': {'usernames': [{'group': 'deploy-ml-service', 'name': 'articletopic-outlink', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'articletopic-outlink-deploy', 'owner': 'root'}]}, 'edit-check': {'usernames': [{'group': 'deploy-ml-service', 'name': 'edit-check', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'edit-check-deploy', 'owner': 'root'}]}, 'experimental': {'usernames': [{'group': 'deploy-ml-service', 'name': 'experimental', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-deploy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-debug', 'owner': 'root'}]}, 'llm': {'usernames': [{'group': 'deploy-ml-service', 'name': 'llm', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'llm-deploy', 'owner': 'root'}]}, 'logo-detection': {'usernames': [{'group': 'deploy-ml-service', 'name': 'logo-detection', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'logo-detection-deploy', 'owner': 'root'}]}, 'ores-legacy': {'usernames': [{'group': 'deploy-ml-service', 'name': 'ores-legacy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'ores-legacy-deploy', 'owner': 'root'}]}, 'readability': {'usernames': [{'group': 'deploy-ml-service', 'name': 'readability', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'readability-deploy', 'owner': 'root'}]}, 'recommendation-api-ng': {'usernames': [{'group': 'deploy-ml-service', 'name': 'recommendation-api-ng', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'recommendation-api-ng-deploy', 'owner': 'root'}]}, 'revertrisk': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revertrisk', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revertrisk-deploy', 'owner': 'root'}]}, 'revise-tone-task-generator': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator-deploy', 'owner': 'root'}]}, 'revision-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revision-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revision-models-deploy', 'owner': 'root'}]}, 'revscoring-articlequality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articlequality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articlequality-deploy', 'owner': 'root'}]}, 'revscoring-articletopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articletopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articletopic-deploy', 'owner': 'root'}]}, 'revscoring-draftquality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-draftquality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-draftquality-deploy', 'owner': 'root'}]}, 'revscoring-drafttopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic-deploy', 'owner': 'root'}]}, 'revscoring-editquality-damaging': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging-deploy', 'owner': 'root'}]}, 'revscoring-editquality-goodfaith': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith-deploy', 'owner': 'root'}]}, 'revscoring-editquality-reverted': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted-deploy', 'owner': 'root'}]}}, 'dse-k8s': {'analytics': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-deploy', 'owner': 'root'}]}, 'analytics-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-test-deploy', 'owner': 'root'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'kafka-ui': {'usernames': [{'name': 'kafka-ui'}, {'name': 'kafka-ui-deploy'}]}, 'opensearch-ipoid': {'usernames': [{'name': 'opensearch-ipoid'}, {'name': 'opensearch-ipoid-deploy'}]}, 'opensearch-ipoid-test': {'usernames': [{'name': 'opensearch-ipoid-test'}, {'name': 'opensearch-ipoid-test-deploy'}]}, 'opensearch-operator': {'usernames': [{'name': 'opensearch-operator'}, {'name': 'opensearch-operator-deploy'}]}, 'opensearch-operator-3': {'usernames': [{'name': 'opensearch-operator-3'}, {'name': 'opensearch-operator-3-deploy'}]}, 'opensearch-semantic-search': {'usernames': [{'name': 'opensearch-semantic-search'}, {'name': 'opensearch-semantic-search-deploy'}]}, 'opensearch-semantic-search-test': {'usernames': [{'name': 'opensearch-semantic-search-test'}, {'name': 'opensearch-semantic-search-test-deploy'}]}, 'opensearch-test': {'usernames': [{'name': 'opensearch-test'}, {'name': 'opensearch-test-deploy'}]}, 'opensearch-toolhub': {'usernames': [{'name': 'opensearch-toolhub'}, {'name': 'opensearch-toolhub-deploy'}]}, 'opensearch-toolhub-test': {'usernames': [{'name': 'opensearch-toolhub-test'}, {'name': 'opensearch-toolhub-test-deploy'}]}, 'opensearch-apifeatureusage': {'usernames': [{'name': 'opensearch-apifeatureusage'}, {'name': 'opensearch-apifeatureusage-deploy'}]}, 'opensearch-apifeatureusage-test': {'usernames': [{'name': 'opensearch-apifeatureusage-test'}, {'name': 'opensearch-apifeatureusage-test-deploy'}]}, 'opensearch-ttmserver': {'usernames': [{'name': 'opensearch-ttmserver'}, {'name': 'opensearch-ttmserver-deploy'}]}, 'opensearch-ttmserver-test': {'usernames': [{'name': 'opensearch-ttmserver-test'}, {'name': 'opensearch-ttmserver-test-deploy'}]}, 'wdqs-internal': {'usernames': [{'name': 'wdqs-internal'}, {'name': 'wdqs-internal-deploy'}]}, 'wdqs-internal-next': {'usernames': [{'name': 'wdqs-internal-next'}, {'name': 'wdqs-internal-next-deploy'}]}, 'wdqs-external': {'usernames': [{'name': 'wdqs-external'}, {'name': 'wdqs-external-deploy'}]}, 'wdqs-external-next': {'usernames': [{'name': 'wdqs-external-next'}, {'name': 'wdqs-external-next-deploy'}]}}, 'dse-k8s-codfw': {'echoserver': {'usernames': [{'name': 'echoserver'}, {'name': 'echoserver-deploy'}]}}, 'dse-k8s-eqiad': {'airflow-analytics-product': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-product', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-product-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product-deploy', 'owner': 'root'}]}, 'airflow-analytics-test': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-test', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-test-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test-deploy', 'owner': 'root'}]}, 'airflow-dev': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-dev', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-dev-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev-deploy', 'owner': 'root'}]}, 'airflow-fr-tech': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-fr-tech', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-fr-tech-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech-deploy', 'owner': 'root'}]}, 'airflow-main': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-main', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-main-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main-deploy', 'owner': 'root'}]}, 'airflow-ml': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-ml', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-ml-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml-deploy', 'owner': 'root'}]}, 'airflow-platform-eng': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-platform-eng', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-platform-eng-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng-deploy', 'owner': 'root'}]}, 'airflow-research': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-research', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-research-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research-deploy', 'owner': 'root'}]}, 'airflow-search': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-search', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-search-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search-deploy', 'owner': 'root'}]}, 'airflow-sre': {'private_files': {'group': 'ops', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-sre', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-sre-deploy', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre-deploy', 'owner': 'root'}]}, 'airflow-test-k8s': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-test-k8s', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-test-k8s-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s-deploy', 'owner': 'root'}]}, 'airflow-wikidata': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wikidata', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wikidata-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata-deploy', 'owner': 'root'}]}, 'airflow-wmde': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wmde', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wmde-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde-deploy', 'owner': 'root'}]}, 'blunderbuss': {'usernames': [{'name': 'blunderbuss'}, {'name': 'blunderbuss-deploy'}]}, 'datahub': {'usernames': [{'name': 'datahub'}, {'name': 'datahub-deploy'}]}, 'datahub-next': {'usernames': [{'name': 'datahub-next'}, {'name': 'datahub-next-deploy'}]}, 'datasets-config': {'usernames': [{'name': 'datasets-config'}, {'name': 'datasets-config-deploy'}]}, 'datasets-config-next': {'usernames': [{'name': 'datasets-config-next'}, {'name': 'datasets-config-next-deploy'}]}, 'eventstreams-internal': {'usernames': [{'name': 'eventstreams-internal'}, {'name': 'eventstreams-internal-deploy'}]}, 'growthbook': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-deploy', 'owner': 'root'}, {'name': 'growthbook'}, {'name': 'growthbook-deploy'}]}, 'growthbook-next': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook-next', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-next-deploy', 'owner': 'root'}, {'name': 'growthbook-next'}, {'name': 'growthbook-next-deploy'}]}, 'llm-inference': {'usernames': [{'group': 'research-deployers', 'name': 'llm-inference', 'owner': 'root'}, {'group': 'research-deployers', 'name': 'llm-inference-deploy', 'owner': 'root'}]}, 'mediawiki-dumps-legacy': {'usernames': [{'name': 'mediawiki-dumps-legacy'}, {'name': 'mediawiki-dumps-legacy-deploy'}]}, 'mw-content-history-reconcile-enrich': {'usernames': [{'name': 'mw-content-history-reconcile-enrich'}, {'name': 'mw-content-history-reconcile-enrich-deploy'}]}, 'mw-content-history-reconcile-enrich-next': {'usernames': [{'name': 'mw-content-history-reconcile-enrich-next'}, {'name': 'mw-content-history-reconcile-enrich-next-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich'}, {'name': 'mw-dump-rev-content-reconcile-enrich-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich-next': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich-next'}, {'name': 'mw-dump-rev-content-reconcile-enrich-next-deploy'}]}, 'mw-page-html-content-change-enrich': {'usernames': [{'name': 'mw-page-html-content-change-enrich'}, {'name': 'mw-page-html-content-change-enrich-deploy'}]}, 'mw-page-html-content-change-enrich-next': {'usernames': [{'name': 'mw-page-html-content-change-enrich-next'}, {'name': 'mw-page-html-content-change-enrich-next-deploy'}]}, 'mw-page-html-feature-counts-change-enrich': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich'}, {'name': 'mw-page-html-feature-counts-change-enrich-deploy'}]}, 'mw-page-html-feature-counts-change-enrich-next': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich-next'}, {'name': 'mw-page-html-feature-counts-change-enrich-next-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'spark': {'usernames': [{'name': 'spark'}, {'name': 'spark-deploy'}]}, 'spark-history': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-deploy', 'owner': 'root'}]}, 'spark-history-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-test-deploy', 'owner': 'root'}]}, 'superset': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-deploy', 'owner': 'root'}]}, 'superset-next': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset-next', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-next-deploy', 'owner': 'root'}]}, 'test-kitchen': {'usernames': [{'name': 'test-kitchen'}, {'name': 'test-kitchen-deploy'}]}, 'test-kitchen-next': {'usernames': [{'name': 'test-kitchen-next'}, {'name': 'test-kitchen-next-deploy'}]}, 'turnilo': {'usernames': [{'name': 'turnilo'}, {'name': 'turnilo-deploy'}]}, 'turnilo-next': {'usernames': [{'name': 'turnilo-next'}, {'name': 'turnilo-next-deploy'}]}, 'webrequest-page-view': {'usernames': [{'name': 'webrequest-page-view'}, {'name': 'webrequest-page-view-deploy'}]}, 'webrequest-page-view-next': {'usernames': [{'name': 'webrequest-page-view-next'}, {'name': 'webrequest-page-view-next-deploy'}]}, 'wdqs-queryhammer': {'usernames': [{'name': 'wdqs-queryhammer'}, {'name': 'wdqs-queryhammer-deploy'}]}}, 'aux-k8s': {'codesearch': {'usernames': [{'name': 'codesearch'}, {'name': 'codesearch-deploy'}]}, 'jaeger': {'usernames': [{'name': 'jaeger'}, {'name': 'jaeger-deploy'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'redioscope': {'usernames': [{'name': 'redioscope'}, {'name': 'redioscope-deploy'}]}, 'sophroid': {'usernames': [{'name': 'sophroid'}, {'name': 'sophroid-deploy'}]}, 'zarcillo': {'usernames': [{'name': 'zarcillo'}, {'name': 'zarcillo-deploy'}]}}}
  +    services => {'main': {'apertium': {'usernames': [{'name': 'apertium'}, {'name': 'apertium-deploy'}]}, 'api-gateway': {'usernames': [{'name': 'api-gateway'}, {'name': 'api-gateway-deploy'}]}, 'benthos-cache-invalidator': {'usernames': [{'name': 'benthos-cache-invalidator'}, {'name': 'benthos-cache-invalidator-deploy'}]}, 'changeprop': {'usernames': [{'name': 'changeprop'}, {'name': 'changeprop-deploy'}]}, 'changeprop-jobqueue': {'usernames': [{'name': 'changeprop-jobqueue'}, {'name': 'changeprop-jobqueue-deploy'}]}, 'chart-renderer': {'usernames': [{'name': 'chart-renderer'}, {'name': 'chart-renderer-deploy'}]}, 'cirrus-streaming-updater': {'usernames': [{'name': 'cirrus-streaming-updater'}, {'name': 'cirrus-streaming-updater-deploy'}]}, 'citoid': {'usernames': [{'name': 'citoid'}, {'name': 'citoid-deploy'}]}, 'commons-impact-analytics': {'usernames': [{'name': 'commons-impact-analytics'}, {'name': 'commons-impact-analytics-deploy'}]}, 'cxserver': {'usernames': [{'name': 'cxserver'}, {'name': 'cxserver-deploy'}]}, 'data-gateway': {'usernames': [{'name': 'data-gateway'}, {'name': 'data-gateway-deploy'}]}, 'developer-portal': {'usernames': [{'name': 'developer-portal'}, {'name': 'developer-portal-deploy'}]}, 'device-analytics': {'usernames': [{'name': 'device-analytics'}, {'name': 'device-analytics-deploy'}]}, 'echostore': {'usernames': [{'name': 'echostore'}, {'name': 'echostore-deploy'}]}, 'edit-analytics': {'usernames': [{'name': 'edit-analytics'}, {'name': 'edit-analytics-deploy'}]}, 'editor-analytics': {'usernames': [{'name': 'editor-analytics'}, {'name': 'editor-analytics-deploy'}]}, 'eventgate-analytics': {'usernames': [{'name': 'eventgate-analytics'}, {'name': 'eventgate-analytics-deploy'}]}, 'eventgate-analytics-external': {'usernames': [{'name': 'eventgate-analytics-external'}, {'name': 'eventgate-analytics-external-deploy'}]}, 'eventgate-logging-external': {'usernames': [{'name': 'eventgate-logging-external'}, {'name': 'eventgate-logging-external-deploy'}]}, 'eventgate-main': {'usernames': [{'name': 'eventgate-main'}, {'name': 'eventgate-main-deploy'}]}, 'eventstreams': {'usernames': [{'name': 'eventstreams'}, {'name': 'eventstreams-deploy'}]}, 'failoid-ng': {'usernames': [{'name': 'failoid-ng'}, {'name': 'failoid-ng-deploy'}]}, 'geo-analytics': {'usernames': [{'name': 'geo-analytics'}, {'name': 'geo-analytics-deploy'}]}, 'ipoid': {'usernames': [{'name': 'ipoid'}, {'name': 'ipoid-deploy'}]}, 'kartotherian': {'usernames': [{'name': 'kartotherian'}, {'name': 'kartotherian-deploy'}]}, 'linked-artifacts': {'usernames': [{'name': 'linked-artifacts'}, {'name': 'linked-artifacts-deploy'}]}, 'linkrecommendation': {'usernames': [{'name': 'linkrecommendation'}, {'name': 'linkrecommendation-deploy'}]}, 'machinetranslation': {'usernames': [{'name': 'machinetranslation'}, {'name': 'machinetranslation-deploy'}]}, 'mathoid': {'usernames': [{'name': 'mathoid'}, {'name': 'mathoid-deploy'}]}, 'media-analytics': {'usernames': [{'name': 'media-analytics'}, {'name': 'media-analytics-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'mobileapps': {'usernames': [{'name': 'mobileapps'}, {'name': 'mobileapps-deploy'}]}, 'mw-api-ext': {'usernames': [{'name': 'mw-api-ext'}, {'name': 'mw-api-ext-deploy'}]}, 'mw-api-int': {'usernames': [{'name': 'mw-api-int'}, {'name': 'mw-api-int-deploy'}]}, 'mw-cron': {'usernames': [{'name': 'mw-cron'}, {'name': 'mw-cron-deploy'}, {'group': 'restricted', 'name': 'mw-cron-restricted'}, {'group': 'restricted', 'name': 'mw-cron-restricted-deploy'}]}, 'mw-debug': {'usernames': [{'name': 'mw-debug'}, {'name': 'mw-debug-deploy'}]}, 'mw-experimental': {'usernames': [{'name': 'mw-experimental'}, {'name': 'mw-experimental-deploy'}]}, 'mw-jobrunner': {'usernames': [{'name': 'mw-jobrunner'}, {'name': 'mw-jobrunner-deploy'}]}, 'mw-mcrouter': {'usernames': [{'name': 'mw-mcrouter'}, {'name': 'mw-mcrouter-deploy'}]}, 'mw-misc': {'usernames': [{'name': 'mw-misc'}, {'name': 'mw-misc-deploy'}]}, 'mw-page-content-change-enrich': {'usernames': [{'name': 'mw-page-content-change-enrich'}, {'name': 'mw-page-content-change-enrich-deploy'}]}, 'mw-parsoid': {'usernames': [{'name': 'mw-parsoid'}, {'name': 'mw-parsoid-deploy'}]}, 'mw-script': {'usernames': [{'name': 'mw-script'}, {'name': 'mw-script-deploy'}, {'group': 'restricted', 'name': 'mw-script-restricted'}, {'group': 'restricted', 'name': 'mw-script-restricted-deploy'}]}, 'mw-videoscaler': {'usernames': [{'name': 'mw-videoscaler'}, {'name': 'mw-videoscaler-deploy'}]}, 'mw-web': {'usernames': [{'name': 'mw-web'}, {'name': 'mw-web-deploy'}]}, 'mw-wikifunctions': {'usernames': [{'name': 'mw-wikifunctions'}, {'name': 'mw-wikifunctions-deploy'}]}, 'opentelemetry-collector': {'usernames': [{'name': 'opentelemetry-collector'}, {'name': 'opentelemetry-collector-deploy'}]}, 'page-analytics': {'usernames': [{'name': 'page-analytics'}, {'name': 'page-analytics-deploy'}]}, 'proton': {'usernames': [{'name': 'proton'}, {'name': 'proton-deploy'}]}, 'push-notifications': {'usernames': [{'name': 'push-notifications'}, {'name': 'push-notifications-deploy'}]}, 'ratelimit': {'usernames': [{'name': 'ratelimit'}, {'name': 'ratelimit-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'recommendation-api': {'usernames': [{'name': 'recommendation-api'}, {'name': 'recommendation-api-deploy'}]}, 'rest-gateway': {'usernames': [{'name': 'rest-gateway'}, {'name': 'rest-gateway-deploy'}]}, 'sessionstore': {'usernames': [{'name': 'sessionstore'}, {'name': 'sessionstore-deploy'}]}, 'shellbox': {'usernames': [{'name': 'shellbox'}, {'name': 'shellbox-deploy'}]}, 'shellbox-constraints': {'usernames': [{'name': 'shellbox-constraints'}, {'name': 'shellbox-constraints-deploy'}]}, 'shellbox-media': {'usernames': [{'name': 'shellbox-media'}, {'name': 'shellbox-media-deploy'}]}, 'shellbox-syntaxhighlight': {'usernames': [{'name': 'shellbox-syntaxhighlight'}, {'name': 'shellbox-syntaxhighlight-deploy'}]}, 'shellbox-timeline': {'usernames': [{'name': 'shellbox-timeline'}, {'name': 'shellbox-timeline-deploy'}]}, 'shellbox-video': {'usernames': [{'name': 'shellbox-video'}, {'name': 'shellbox-video-deploy'}]}, 'tegola-vector-tiles': {'usernames': [{'name': 'tegola-vector-tiles'}, {'name': 'tegola-vector-tiles-deploy'}]}, 'termbox': {'usernames': [{'name': 'termbox'}, {'name': 'termbox-deploy'}]}, 'thumbor': {'usernames': [{'name': 'thumbor'}, {'name': 'thumbor-deploy'}]}, 'toolhub': {'usernames': [{'name': 'toolhub'}, {'name': 'toolhub-deploy'}]}, 'wikidata-query-gui': {'usernames': [{'name': 'wikidata-query-gui'}, {'name': 'wikidata-query-gui-deploy'}]}, 'wikifeeds': {'usernames': [{'name': 'wikifeeds'}, {'name': 'wikifeeds-deploy'}]}, 'wikifunctions': {'usernames': [{'name': 'wikifunctions'}, {'name': 'wikifunctions-deploy'}]}, 'zotero': {'usernames': [{'name': 'zotero'}, {'name': 'zotero-deploy'}]}}, 'ml-serve': {'article-descriptions': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-descriptions', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-descriptions-deploy', 'owner': 'root'}]}, 'article-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'article-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'article-models-deploy', 'owner': 'root'}]}, 'articletopic-outlink': {'usernames': [{'group': 'deploy-ml-service', 'name': 'articletopic-outlink', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'articletopic-outlink-deploy', 'owner': 'root'}]}, 'edit-check': {'usernames': [{'group': 'deploy-ml-service', 'name': 'edit-check', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'edit-check-deploy', 'owner': 'root'}]}, 'experimental': {'usernames': [{'group': 'deploy-ml-service', 'name': 'experimental', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-deploy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'experimental-debug', 'owner': 'root'}]}, 'llm': {'usernames': [{'group': 'deploy-ml-service', 'name': 'llm', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'llm-deploy', 'owner': 'root'}]}, 'logo-detection': {'usernames': [{'group': 'deploy-ml-service', 'name': 'logo-detection', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'logo-detection-deploy', 'owner': 'root'}]}, 'ores-legacy': {'usernames': [{'group': 'deploy-ml-service', 'name': 'ores-legacy', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'ores-legacy-deploy', 'owner': 'root'}]}, 'readability': {'usernames': [{'group': 'deploy-ml-service', 'name': 'readability', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'readability-deploy', 'owner': 'root'}]}, 'recommendation-api-ng': {'usernames': [{'group': 'deploy-ml-service', 'name': 'recommendation-api-ng', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'recommendation-api-ng-deploy', 'owner': 'root'}]}, 'revertrisk': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revertrisk', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revertrisk-deploy', 'owner': 'root'}]}, 'revise-tone-task-generator': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revise-tone-task-generator-deploy', 'owner': 'root'}]}, 'revision-models': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revision-models', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revision-models-deploy', 'owner': 'root'}]}, 'revscoring-articlequality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articlequality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articlequality-deploy', 'owner': 'root'}]}, 'revscoring-articletopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-articletopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-articletopic-deploy', 'owner': 'root'}]}, 'revscoring-draftquality': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-draftquality', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-draftquality-deploy', 'owner': 'root'}]}, 'revscoring-drafttopic': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-drafttopic-deploy', 'owner': 'root'}]}, 'revscoring-editquality-damaging': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-damaging-deploy', 'owner': 'root'}]}, 'revscoring-editquality-goodfaith': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-goodfaith-deploy', 'owner': 'root'}]}, 'revscoring-editquality-reverted': {'usernames': [{'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted', 'owner': 'root'}, {'group': 'deploy-ml-service', 'name': 'revscoring-editquality-reverted-deploy', 'owner': 'root'}]}}, 'dse-k8s': {'analytics': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-deploy', 'owner': 'root'}]}, 'analytics-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'analytics-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'analytics-test-deploy', 'owner': 'root'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'kafka-ui': {'usernames': [{'name': 'kafka-ui'}, {'name': 'kafka-ui-deploy'}]}, 'opensearch-ipoid': {'usernames': [{'name': 'opensearch-ipoid'}, {'name': 'opensearch-ipoid-deploy'}]}, 'opensearch-ipoid-test': {'usernames': [{'name': 'opensearch-ipoid-test'}, {'name': 'opensearch-ipoid-test-deploy'}]}, 'opensearch-operator': {'usernames': [{'name': 'opensearch-operator'}, {'name': 'opensearch-operator-deploy'}]}, 'opensearch-operator-3': {'usernames': [{'name': 'opensearch-operator-3'}, {'name': 'opensearch-operator-3-deploy'}]}, 'opensearch-semantic-search': {'usernames': [{'name': 'opensearch-semantic-search'}, {'name': 'opensearch-semantic-search-deploy'}]}, 'opensearch-semantic-search-test': {'usernames': [{'name': 'opensearch-semantic-search-test'}, {'name': 'opensearch-semantic-search-test-deploy'}]}, 'opensearch-test': {'usernames': [{'name': 'opensearch-test'}, {'name': 'opensearch-test-deploy'}]}, 'opensearch-toolhub': {'usernames': [{'name': 'opensearch-toolhub'}, {'name': 'opensearch-toolhub-deploy'}]}, 'opensearch-toolhub-test': {'usernames': [{'name': 'opensearch-toolhub-test'}, {'name': 'opensearch-toolhub-test-deploy'}]}, 'opensearch-apifeatureusage': {'usernames': [{'name': 'opensearch-apifeatureusage'}, {'name': 'opensearch-apifeatureusage-deploy'}]}, 'opensearch-apifeatureusage-test': {'usernames': [{'name': 'opensearch-apifeatureusage-test'}, {'name': 'opensearch-apifeatureusage-test-deploy'}]}, 'opensearch-ttmserver': {'usernames': [{'name': 'opensearch-ttmserver'}, {'name': 'opensearch-ttmserver-deploy'}]}, 'opensearch-ttmserver-test': {'usernames': [{'name': 'opensearch-ttmserver-test'}, {'name': 'opensearch-ttmserver-test-deploy'}]}, 'wdqs': {'usernames': [{'name': 'wdqs'}, {'name': 'wdqs-deploy'}]}, 'wdqs-next': {'usernames': [{'name': 'wdqs-next'}, {'name': 'wdqs-next-deploy'}]}}, 'dse-k8s-codfw': {'echoserver': {'usernames': [{'name': 'echoserver'}, {'name': 'echoserver-deploy'}]}}, 'dse-k8s-eqiad': {'airflow-analytics-product': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-product', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-product-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-product-deploy', 'owner': 'root'}]}, 'airflow-analytics-test': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-analytics-test', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-analytics-test-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-analytics-test-deploy', 'owner': 'root'}]}, 'airflow-dev': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-dev', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-dev-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-dev-deploy', 'owner': 'root'}]}, 'airflow-fr-tech': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-fr-tech', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-fr-tech-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-fr-tech-deploy', 'owner': 'root'}]}, 'airflow-main': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-main', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-main-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-main-deploy', 'owner': 'root'}]}, 'airflow-ml': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-ml', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-ml-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-ml-deploy', 'owner': 'root'}]}, 'airflow-platform-eng': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-platform-eng', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-platform-eng-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-platform-eng-deploy', 'owner': 'root'}]}, 'airflow-research': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-research', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-research-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-research-deploy', 'owner': 'root'}]}, 'airflow-search': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-search', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-search-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-search-deploy', 'owner': 'root'}]}, 'airflow-sre': {'private_files': {'group': 'ops', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-sre', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-sre-deploy', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre', 'owner': 'root'}, {'group': 'ops', 'name': 'airflow-sre-deploy', 'owner': 'root'}]}, 'airflow-test-k8s': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-test-k8s', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-test-k8s-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-test-k8s-deploy', 'owner': 'root'}]}, 'airflow-wikidata': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wikidata', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wikidata-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wikidata-deploy', 'owner': 'root'}]}, 'airflow-wmde': {'private_files': {'group': 'airflow-deployers', 'mode': '0640', 'owner': 'root'}, 'usernames': [{'group': 'root', 'name': 'postgresql-airflow-wmde', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-airflow-wmde-deploy', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde', 'owner': 'root'}, {'group': 'airflow-deployers', 'name': 'airflow-wmde-deploy', 'owner': 'root'}]}, 'blunderbuss': {'usernames': [{'name': 'blunderbuss'}, {'name': 'blunderbuss-deploy'}]}, 'datahub': {'usernames': [{'name': 'datahub'}, {'name': 'datahub-deploy'}]}, 'datahub-next': {'usernames': [{'name': 'datahub-next'}, {'name': 'datahub-next-deploy'}]}, 'datasets-config': {'usernames': [{'name': 'datasets-config'}, {'name': 'datasets-config-deploy'}]}, 'datasets-config-next': {'usernames': [{'name': 'datasets-config-next'}, {'name': 'datasets-config-next-deploy'}]}, 'eventstreams-internal': {'usernames': [{'name': 'eventstreams-internal'}, {'name': 'eventstreams-internal-deploy'}]}, 'growthbook': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-deploy', 'owner': 'root'}, {'name': 'growthbook'}, {'name': 'growthbook-deploy'}]}, 'growthbook-next': {'usernames': [{'group': 'root', 'name': 'postgresql-growthbook-next', 'owner': 'root'}, {'group': 'root', 'name': 'postgresql-growthbook-next-deploy', 'owner': 'root'}, {'name': 'growthbook-next'}, {'name': 'growthbook-next-deploy'}]}, 'llm-inference': {'usernames': [{'group': 'research-deployers', 'name': 'llm-inference', 'owner': 'root'}, {'group': 'research-deployers', 'name': 'llm-inference-deploy', 'owner': 'root'}]}, 'mediawiki-dumps-legacy': {'usernames': [{'name': 'mediawiki-dumps-legacy'}, {'name': 'mediawiki-dumps-legacy-deploy'}]}, 'mw-content-history-reconcile-enrich': {'usernames': [{'name': 'mw-content-history-reconcile-enrich'}, {'name': 'mw-content-history-reconcile-enrich-deploy'}]}, 'mw-content-history-reconcile-enrich-next': {'usernames': [{'name': 'mw-content-history-reconcile-enrich-next'}, {'name': 'mw-content-history-reconcile-enrich-next-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich'}, {'name': 'mw-dump-rev-content-reconcile-enrich-deploy'}]}, 'mw-dump-rev-content-reconcile-enrich-next': {'usernames': [{'name': 'mw-dump-rev-content-reconcile-enrich-next'}, {'name': 'mw-dump-rev-content-reconcile-enrich-next-deploy'}]}, 'mw-page-html-content-change-enrich': {'usernames': [{'name': 'mw-page-html-content-change-enrich'}, {'name': 'mw-page-html-content-change-enrich-deploy'}]}, 'mw-page-html-content-change-enrich-next': {'usernames': [{'name': 'mw-page-html-content-change-enrich-next'}, {'name': 'mw-page-html-content-change-enrich-next-deploy'}]}, 'mw-page-html-feature-counts-change-enrich': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich'}, {'name': 'mw-page-html-feature-counts-change-enrich-deploy'}]}, 'mw-page-html-feature-counts-change-enrich-next': {'usernames': [{'name': 'mw-page-html-feature-counts-change-enrich-next'}, {'name': 'mw-page-html-feature-counts-change-enrich-next-deploy'}]}, 'rdf-streaming-updater': {'usernames': [{'name': 'rdf-streaming-updater'}, {'name': 'rdf-streaming-updater-deploy'}]}, 'spark': {'usernames': [{'name': 'spark'}, {'name': 'spark-deploy'}]}, 'spark-history': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-deploy', 'owner': 'root'}]}, 'spark-history-test': {'usernames': [{'group': 'analytics-deployers', 'name': 'spark-history-test', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'spark-history-test-deploy', 'owner': 'root'}]}, 'superset': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-deploy', 'owner': 'root'}]}, 'superset-next': {'usernames': [{'group': 'analytics-deployers', 'name': 'superset-next', 'owner': 'root'}, {'group': 'analytics-deployers', 'name': 'superset-next-deploy', 'owner': 'root'}]}, 'test-kitchen': {'usernames': [{'name': 'test-kitchen'}, {'name': 'test-kitchen-deploy'}]}, 'test-kitchen-next': {'usernames': [{'name': 'test-kitchen-next'}, {'name': 'test-kitchen-next-deploy'}]}, 'turnilo': {'usernames': [{'name': 'turnilo'}, {'name': 'turnilo-deploy'}]}, 'turnilo-next': {'usernames': [{'name': 'turnilo-next'}, {'name': 'turnilo-next-deploy'}]}, 'webrequest-page-view': {'usernames': [{'name': 'webrequest-page-view'}, {'name': 'webrequest-page-view-deploy'}]}, 'webrequest-page-view-next': {'usernames': [{'name': 'webrequest-page-view-next'}, {'name': 'webrequest-page-view-next-deploy'}]}, 'wdqs-queryhammer': {'usernames': [{'name': 'wdqs-queryhammer'}, {'name': 'wdqs-queryhammer-deploy'}]}}, 'aux-k8s': {'codesearch': {'usernames': [{'name': 'codesearch'}, {'name': 'codesearch-deploy'}]}, 'jaeger': {'usernames': [{'name': 'jaeger'}, {'name': 'jaeger-deploy'}]}, 'kafka-mirrormaker': {'usernames': [{'name': 'kafka-mirrormaker'}, {'name': 'kafka-mirrormaker-deploy'}]}, 'miscweb': {'usernames': [{'name': 'miscweb'}, {'name': 'miscweb-deploy'}]}, 'redioscope': {'usernames': [{'name': 'redioscope'}, {'name': 'redioscope-deploy'}]}, 'sophroid': {'usernames': [{'name': 'sophroid'}, {'name': 'sophroid-deploy'}]}, 'zarcillo': {'usernames': [{'name': 'zarcillo'}, {'name': 'zarcillo-deploy'}]}}}
  

• File[/etc/kubernetes/pki/dse__wdqs-internal.csr]

  Parameters differences:

  --- File[/etc/kubernetes/pki/dse__wdqs-internal.csr].orig
  +++ File[/etc/kubernetes/pki/dse__wdqs-internal.csr]
  
  -    mode   => 0440
  -    owner  => mwdeploy
  -    group  => deployment
  -    ensure => file
  

• K8s::Kubeconfig[/etc/kubernetes/wdqs-next-dse-k8s-codfw.config]

  Parameters differences:

  --- K8s::Kubeconfig[/etc/kubernetes/wdqs-next-dse-k8s-codfw.config].orig
  +++ K8s::Kubeconfig[/etc/kubernetes/wdqs-next-dse-k8s-codfw.config]
  
  +    master_host => dse-k8s-ctrl.svc.codfw.wmnet
  +    require     => ['Class[K8s::Base_dirs]']
  +    owner       => mwdeploy
  +    namespace   => wdqs-next
  +    mode        => 0640
  +    ensure      => present
  +    username    => wdqs-next
  +    auth_cert   => {'cert': '/etc/kubernetes/pki/dse__wdqs-next.pem', 'key': '/etc/kubernetes/pki/dse__wdqs-next-key.pem', 'chain': '/etc/kubernetes/pki/dse__wdqs-next.chain.pem', 'chained': '/etc/kubernetes/pki/dse__wdqs-next.chained.pem'}
  +    group       => deployment
  

Relevant files

• Production catalog
• Change catalog
• Production errors/warnings
• Change errors/warnings
• Core Diff
• Standard Diff