We have rpcbind needlessly installed/running on half the fleet.
It gets pulled in as a "Recommends:" of nagios-plugins-standard for the check_rpc Nagios plugin, but that plugin is only used on dataset1001 and maybe a few other hosts. We should trim that down.
A similar issue exists with smbclient: nagios-plugins-standard recommends it, which in turn pulls in a lot of Samba-related libraries. Since we neither use CIFS shares nor any Windows systems, I doubt it is used at all.
nfs-common and rpcbind get installed during the initial d-i base installation. At this point our apt config to not install recommended packages is not yet in place (and I've also found no preseed option to configure that). IIRC d-i also uses anna and not apt, so maybe it's not even supported.
I think the cleanest solution would be to remove nfs-common and rpcbind in late-command.sh and fix our puppet code to explicitly install the packages where they're actually needed (dumps/NFS and labstore). And remove them from the rest.
Although rpcbind is normally blocked by ferm, it's better to not even have it installed from the start. Also e.g. lvs and cp* already have a hack in place (base::no_nfs_client), which would then be obsolete as well.
Change 352097 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] labstore: Explicitly declare package dependencies for nfs-common and rpcbind
Change 352105 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Strip nfs-common/rpcbind during jessie base installation
I doublechecked production hosts:
Hosts which have an /etc/exports:
dataset1001.wikimedia.org
labstore1003.eqiad.wmnet
labstore1004.eqiad.wmnet
labstore1005.eqiad.wmnet
ms1001.wikimedia.org
Hosts which have an NFS mount in their mtab:
dataset1001.wikimedia.org
labstore1003.eqiad.wmnet
labstore1005.eqiad.wmnet
ms1001.wikimedia.org
snapshot1001.eqiad.wmnet
snapshot1005.eqiad.wmnet
snapshot1006.eqiad.wmnet
snapshot1007.eqiad.wmnet
stat1002.eqiad.wmnet
stat1003.eqiad.wmnet
Change 352097 merged by Rush:
[operations/puppet@production] labstore: Explicitly declare package dependencies for nfs-common and rpcbind
Change 352105 merged by Muehlenhoff:
[operations/puppet@production] Strip nfs-common/rpcbind during jessie base installation
Change 352748 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Drop cache/LVS NFS override
Mentioned in SAL (#wikimedia-operations) [2017-05-09T07:34:54Z] <moritzm> removing unneeded rpcbind/nfs-common packages (T106477)
Change 352748 merged by Muehlenhoff:
[operations/puppet@production] Drop cache/LVS NFS override
rpcbind and nfs-common have been removed from all jessie hosts except those which actually use NFS. In addition our base d-i jessie installation strips nfs-common and rpcbind during base install.