[11:40:48] moritzm: apologies, I have run full-upgrade on the wrong host (cumin1002) [11:41:03] I am checking if I have broken something or need to downgrade some package [11:42:17] this installed a wide range of bpo packages, though? [11:42:31] indeed [11:42:34] let me get the logs [11:43:05] I can undo those [11:44:32] all good, I'll take care of it [11:44:49] most of these were from the bookworm point update from last weekend anyway [11:46:22] https://phabricator.wikimedia.org/P72003 [11:47:00] ack, I'm fixing these up to the standard distro versions [11:48:14] I think except for python, the other should be safe in that the probably didn't break anything (misc tools) [11:49:51] possibly, but bpo isn't consistently updated with security updates, so I'm reverting these to the native distro versions anyway [11:50:02] yes, I guessed so [11:50:15] also, support for bullseye-backports has ended and might get archived at some point [11:50:15] let me know if you want help, as I could be doing those myself [11:50:24] all good! [11:51:14] didn't want to give you more work, just communicating early, as soon as I realized [11:51:30] no worries at all, mistakes happen [18:02:25] an update to my update during the incident review, we didn't actually do it; limit-by-source is per-IP egress and we need to also roll out limit-by-path which is presently only eqsin/ulsfo/eqiad [18:03:14] so I am again writing a patch 😅 [18:18:55] <3 [18:20:36] sukhe: https://gerrit.wikimedia.org/r/c/operations/puppet/+/1110826 ptal :D [18:23:58] cdanis: in a meeting, happy to look shortly [18:24:01] in case someone else doesn't [18:24:28] no worries, I have a meeting in half an hour anyway, so won't be rolling it out before then [20:34:29] Hey folks, I'd like to remove some unused admin groups: [20:34:29] https://gerrit.wikimedia.org/r/c/operations/puppet/+/1110845 [20:34:29] according to https://github.com/wikimedia/operations-puppet/blob/production/modules/admin/README.md#removing-a-group, I should be able to ensure: absent [20:34:29] however: [20:34:30] https://integration.wikimedia.org/ci/job/operations-puppet-tests-bullseye/4464/console [20:34:31] 15:32:01 FAIL: unable to validate data.yaml: [20:34:31] 15:32:01 Additional properties are not allowed ('ensure' was unexpected) [20:37:59] hmm [20:40:59] ottomata: I think perhaps the docs are wrong, and the thing to do instead is to set `deprecated: true` ? but I'm not sure, I'm just guessing from how the docs are older than https://phabricator.wikimedia.org/T248161 [20:41:08] that will assert the groups stay empty though [20:43:24] Moritz is probably the best one to speak to the intended state :) [20:45:30] or is it because of line 494, where there is still the alias in "members:" so it's technically not an empty group? but yes, just ask Moritz [20:46:06] maybe try though if it changes to change 494 to: members: [] [20:49:27] mutante: no, that error message says that the `ensure` key isn't allowed in that point in the struct at all [20:49:43] there's a separate CI check for things like deprecated groups having 0 members [21:08:17] ack, maybe it would have done the CI -1 separately