The $network::constants::mw_appserver_networks Puppet variable, used for access control in various places in Puppet, currently contains:

• The public networks in eqiad/codfw rows a/b/c/d
• The private networks in eqiad/codfw rows a/b/c/d/e/f
• Kubernetes pod ranges for all production K8s clusters

There have been no MW app servers in the public networks since Wikitech was moved to Kubernetes, and recently there's been no app servers outside K8s at all. So if we're believing the original name of the variable, presumably only Wikikube ranges should remain listed in there and the rest need to be removed.

However, that variable (and the related deployable_networks variable) seem to be used for various other things these days. For example it seems like the Apache site for Scap3 deploys is restricted to that ACL as well. So it's possible that the variable just needs a rename (or some explanatory comments) to match its purpose in reality. (Or perhaps it should be removed entirely and replaced with some other authentication mechanism that doesn't rely on all-or-nothing network trusts?)