I think the fundamental problem with PuppetDB and OpenVoxDB blocklists is that they were implemented in response to a proliferation of legacy facts, so they only look at top level fact names. Trying to block

networking.interfaces.cali.*

doesn't work, because the service blocklist filter only sees

networking

:

(defn rm-facts-by-regex [facts-blocklist fact-map]
  (let [blocklisted? (fn [fact-name]
                       (some #(re-matches % fact-name) facts-blocklist))]
    (apply dissoc fact-map (filter blocklisted? (keys fact-map)))))
                                                 ^--- this only gets top-level keys from the factset