When using firewall::service and nftables as the firewall provider, ferm and packages installed by it are being removed by puppet.

This isn't an issue as long as libnet-dns-perl isn't installed by something else.

But some hosts, like lists and vrts install libnet-dns-perl for other unrelated reasons.

For example on lists, it's pulled in by spamd/spamassassin.

If such a host is switched to nftables there is a package installation cycle. On every single puppet run, libnet-dns-perl and with it spamd/spamassassin packages as well (!) get removed.

Then on the next run they get installed again.

Noticed by one of the "puppet change on every run" monitoring alerts.

The code that removes the package seems to be this directly in the ferm class:

class ferm (
    Wmflib::Ensure $ensure ='present'
) {
    # @resolve requires libnet-dns-perl
    package { ['iptables', 'libnet-dns-perl']:
        ensure => stdlib::ensure($ensure, package),
    }

In class firewall the whole ferm class is absented when ferm is not the firewall provider.

class firewall (
    Firewall::Provider $provider = 'none',
) {
    unless $provider == 'none' {
        class { 'ferm': # lint:ignore:wmf_styleguide
            ensure => stdlib::ensure($provider == 'ferm'),
        }

Needs a fix one way or another. Patches or just comments very welcome!