From a conversation on -observability re: T350694 and the fact that removing nrpe checks spams icinga with UNKNOWN until puppet has converged on all hosts *and* alert hosts:
09:36 <volans> if you want it to be general, a list either via hiera or command line of exported resources to ignore
09:37 <volans> you add the one to be removed to the ignore, run puppet on icinga that will remove all the checks
09:37 <volans> then run the patch to remove the check
09:37 <volans> the day after remove the ignore from naggen
09:37 <volans> something along those lines
09:38 <volans> it's probably quicker to modify nrpe::monitor_service to allow to absent separately the
monitoring::service first and the nrpe::check at a second stage though