2. Configuration Report 2/5/2016 Document reference2 21/05/2015 – 28/05/2015

3. Incidents and interventions Puppet Server Upgrade 28/05/2015 10.00h OTG0021684 Puppet masters upgraded to Puppet 3.7.5 this morning Some puppet runs failed as expected 2/5/2016 Document reference3

4. Puppet 3.7.5 & Facter 2.4.3 Both packages in production since 27/05/2015 Puppet 3.7.5 [CRM-1139] Puppet MCollective agent working on CC7 Puppet ‘future’ parser is now equivalent to the one included in Puppet 4 Facter 2.4.3 [CRM-1134] Facts are not only strings anymore New structured facts 2/5/2016 Document reference4

5. AI-4222 Apache Module upgrade Current plan New, non-backwards compatible Apache module will live in : production qa Old module is already available in: gold_production_apache040 gold_qa_apache040 The idea is to move affected hosts to the new golden environments so you can migrate at your own pace 2/5/2016 Document reference5

6. AI-4220: List of affected HGs 102 punch 81 dashboard 22 voatlasmisc 22 aimon 16 its 15 svn 14 cds 12 inspire 7 videoconference 7 teigi 6 twiki 6 licmon 6 git 6 ailbd 5 security 5 scoap3 5 castortapelog 5 aici 4 vopanda 4 vocms 4 forge 4 aiermis 3 cc 2 wlcghammercloud 2 voatlasddm 2 mimir 2/5/2016 Document reference6 2 jabber 2 grid_wlmanagement 2 ci 2 bamboo_ci 1 volhcb 1 voatlasbuild 1 procurement 1 playground 1 indicomobile 1 indico 1 indic8r 1 hadoop 1 epublishing 1 backup

7. concat module broken in QA puppetlabs-concat -> v2.0.0 [CRM-1167] ‘concat::setup’ removed in v2.0.0 but still a few modules relying on this Cleanup of affected modules done centrally but still present in a few hostgroups Proposed date to production is now 10/06/2015 2/5/2016 Document reference7

8. LB alias logs in new SLS 2/5/2016 Document reference8

9. LB alias new hostgroup policy Requesting an LB alias requires to specify a hostgroup since a while As a security measure, LB aliases which contain hosts from different base hostgroups will start to be rejected soon For old aliases, hostgroup will be inferred from members 2/5/2016 Document reference9

10. Other ongoing tasks Current Sprint One puppet module being moved to gitlab Starting with one to get experience before moving everything Adapting our tools to use PuppetDB API v4 New server-side git hooks for puppet code validation coming soon 2/5/2016 Document reference10

11. New Configuration items Hostgroups None Modules + aitools + htcondor_ce – drbd 2/5/2016 Document reference11

12. Changes in QA CRM-1040 Validation change in XSLS sensor CRM-1080 new release of lemon-sensor-xsls CRM-1133 osrepos: Make cx_Oracle available for RHEL CRM-1149 add support for job arrays in PoolFull CRM-1159 Enable IPv6 Firewall Part Two CRM-1160 Remove nescesity for osrepos::ai121yumrepo CRM-1164 Upgrade memcached module to v2.7.1 CRM-1167 puppetlabs-concat v1.1.2 -> v2.0.0 CRM-1168 new version of python-pyasn1 to batch6-qa CRM-1169 new version of python-cffi to batch6-qa CRM-1170 new version of python-ecdsa to batch6-qa CRM-1171 new version of python-crypto to batch6-qa CRM-1172 new version of python-gssapi to batch6-qa CRM-1173 new version of python-paramiko to batch6-qa CRM-1176 mcollective fact cron should output to log file. CRM-1177 Fix bug on productserialassettag Fact (private method split) CRM-1178 adamcrews-mlocate 0.1.2 -> 0.2.0 CRM-1180 Security: netlog: Update whitelist (puppet balancer split) CRM-1181 security: remove deprecated hiera-based switch CRM-1182 [CC7] Security: Introduce custom local log forwarder CRM-1183 Remove concat::setup from autofs module. CRM-1185 Drop concat::setup from server side of puppet CRM-1187 Remove concat::setup from sysfs module. 2/5/2016 Document reference12

13. Changes to Production CRM-1065 security: new kernel module for netlog (SLC6/CC7) and execlog (CC7): 2.8-4 CRM-1089 Security: New dresden release CRM-1102 CERNOps-cvmfs 0.3.2 -> 0.5.0 CRM-1131 puppet-stdlib 4.3.2 -> 4.6.0 CRM-1134 New Facter 1.7.6 -> 2.4.3 CRM-1136 Drop basename function from common since now in stdlib CRM-1139 Puppet client upgrade to 3.7.5 CRM-1142 Exclude trustedcas and system_uptime from mcollective facts database. CRM-1144 Split /etc/mcollective/facts.yaml to /etc/mcollective/scope-facts.yaml and facters-facts.yaml CRM-1147 Make cern_os_tenant work with new (and old) facter CRM-1148 Fix type deprecation warnings in lemon module CRM-1150 is_virtual could be true or 'true' in base. CRM-1151 new version of itmon-flume-extra CRM-1154 Tag resources in old apache module with 'apache040' CRM-1155 Tag resources in old shibboleth module with 'apache040' CRM-1157 Added packageinventory to shared resources CRM-1158 add morphlines support to flume::agent and flume::tail CRM-1162 Puppet should not require concat's private API. CRM-1163 Keytab should not require concat's private API. CRM-1166 CLONE - Add attributePrefix option to ApplicationDefaults element CRM-1174 cern_physics_storage_clients - versionlock to 4.1.2 as workaround missing "compat" package in 4.2 2/5/2016 Document reference13