bd808@deployment-cache-text08:~$ sudo -i puppet agent -tv Info: Using environment 'production' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Loading facts Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Function Call, Class[Profile::Cache::Haproxy]: parameter 'available_unified_certificates' entry 'lets-encrypt' expects a value for key 'ocsp' (file: /srv/puppet_code/environments/production/modules/role/manifests/cache/text.pp, line: 4, column: 5) on node deployment-cache-text08.deployment-prep.eqiad1.wikimedia.cloud Warning: Not using cache on failed catalog Error: Could not retrieve catalog; skipping run
diff --git a/deployment-prep/deployment-cache.yaml b/deployment-prep/deployment-cache.yaml index 06fe02b..8937736 100644 --- a/deployment-prep/deployment-cache.yaml +++ b/deployment-prep/deployment-cache.yaml @@ -42,6 +42,7 @@ - /etc/acmecerts/unified/live/rsa-2048.chained.crt.key - /etc/acmecerts/unified/live/ec-prime256v1.chained.crt.key critical_threshold: 15 + ocsp: false server_names: - '*.wikimedia.beta.wmflabs.org' - beta.wmflabs.org
bd808@deployment-cache-text08:~$ sudo -i puppet agent -tv Info: Using environment 'production' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Loading facts Info: Caching catalog for deployment-cache-text08.deployment-prep.eqiad1.wikimedia.cloud Info: Applying configuration version '(3e8cb84843) gitpuppet - beta: Remove unused beta-specific "w.beta.wmcloud.org" vhost' Notice: /Stage[main]/Prometheus::Varnishkafka_exporter/Service[prometheus-varnishkafka-exporter]/ensure: ensure changed 'stopped' to 'running' (corrective) Info: /Stage[main]/Prometheus::Varnishkafka_exporter/Service[prometheus-varnishkafka-exporter]: Unscheduling refresh on Service[prometheus-varnishkafka-exporter] Notice: Applied catalog in 18.40 seconds
This is one that would not have been fixed by Cloud VPS puppet applying role hiera settings as it goes in a section of config that is Beta Cluster specific. The upstream Puppet change could have included a default for the new setting rather than expecting all callers to be updated, but it is debatable whether that would be a proper solution or just a way to kick the configuration compatibility can down the road a bit.