We have a puppet manifest that runs `dnsquery::a()` that fails in PCC for the domain `private.codfw.wikimedia.cloud`.
Example failure:
https://puppet-compiler.wmflabs.org/output/919292/41158/cloudlb2001-dev.codfw.wmnet/index.html
Code:
```lang=shell-session
user@laptop~/git/wmf/operations/puppet production $ git grep dnsquery | grep cloud
modules/cloudlb/manifests/haproxy/service.pp: dnsquery::a($host)[0]
modules/cloudlb/spec/defines/haproxy_service_spec.rb: function dnsquery::a($fqdn) {
modules/cloudlb/templates/haproxy/conf.d/http-service.cfg.erb: server <%= server %> <%= scope.call_function('dnsquery::a', [server])[0] %>:<%= @port_backend %> check inter 3s rise 2 fall 4
modules/profile/manifests/wmcs/cloud_private_subnet.pp: $cloud_private_address = dnsquery::a($cloud_private_fqdn)[0]
modules/profile/manifests/wmcs/cloud_private_subnet.pp: $gw_address = dnsquery::a($gw_fqdn)[0]
modules/profile/spec/classes/profile_wmcs_cloud_private_subnet_spec.rb: "function dnsquery::a($fqdn) {
```
In `modules/profile/manifests/wmcs/cloud_private_subnet.pp for` for host `cloudlb2001-dev.codfw.wmnet` the manifest contains a `dnsquery::a` call for `cloudlb2001-dev.private.codfw.wikimedia.cloud` that would otherwise resolve just fine in the actual puppetmaster but fails in PCC.