The wikimedia.cloud domain fails to resolve in some circumstances inside WMCS VM instances.
One example failure: We have a puppet manifest that runs dnsquery::a() that fails in PCC for the domain private.codfw.wikimedia.cloud.
Code:
user@laptop~/git/wmf/operations/puppet production $ git grep dnsquery | grep cloud modules/cloudlb/manifests/haproxy/service.pp: dnsquery::a($host)[0] modules/cloudlb/spec/defines/haproxy_service_spec.rb: function dnsquery::a($fqdn) { modules/cloudlb/templates/haproxy/conf.d/http-service.cfg.erb: server <%= server %> <%= scope.call_function('dnsquery::a', [server])[0] %>:<%= @port_backend %> check inter 3s rise 2 fall 4 modules/profile/manifests/wmcs/cloud_private_subnet.pp: $cloud_private_address = dnsquery::a($cloud_private_fqdn)[0] modules/profile/manifests/wmcs/cloud_private_subnet.pp: $gw_address = dnsquery::a($gw_fqdn)[0] modules/profile/spec/classes/profile_wmcs_cloud_private_subnet_spec.rb: "function dnsquery::a($fqdn) {
In modules/profile/manifests/wmcs/cloud_private_subnet.pp for for host cloudlb2001-dev.codfw.wmnet the manifest contains a dnsquery::a call for cloudlb2001-dev.private.codfw.wikimedia.cloud that would otherwise resolve just fine in the actual puppetmaster but fails in PCC.