Since the backup cron is now a systemd timer to reduce unread email spam and improve monitoring (a serious alert by icinga needs to be tested still, but in theory it should catch a systemd timer gone bad that exits with non-zero). It seems like we should move other crons to that. The backup cron from the "secondary" file server role is the best example of one working in puppet.
A good example of where I think we'd benefit is the issues with emails coming out from the keystone jobs.
[] profile::base::labs
[] profile::wmcs::tenants::libraryupgrader
[x] profile::wmcs::monitoring
[x] profile::toolforge::clush::master
[] role::prometheus::labs_project
[] role::prometheus::tools
[] role::labs::db::check_private_data
[] role::labs::nfs::secondary
[] role::openldap::labs
[] dnsrecursor::labsaliaser
[] labstore::fileserver::exports
[] graphite::wmcs::archiver
[x] openstack::keystone::cleanup
[x] openstack::glance::image_sync
[x] openstack::wikitech::web
[x] openstack::designate::dns_floating_ip_updater
[x] openstack::puppet::master::instance_info_dumper