commit c82b960ad4293947acbff27429bad5639d3a4692
Author: Steve Traylen <steve.traylen@cern.ch>
Date:   Thu Dec 16 14:55:03 2021 +0100

    rubocop:auto_correct results

diff --git a/lib/facter/nftables.rb b/lib/facter/nftables.rb
index 237ce5d..00aa547 100644
--- a/lib/facter/nftables.rb
+++ b/lib/facter/nftables.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 #
 # Produce an array of nftables.
 # nft list tables
@@ -17,11 +19,11 @@ Facter.add(:nftables) do
     tables = []
     table_result = Facter::Core::Execution.execute(%(#{@nft_cmd} list tables))
     table_result.each_line do |line|
-      tables.push(line.split(' ')[1, 2].join('-'))
+      tables.push(line.split[1, 2].join('-'))
     end
     version = Facter::Core::Execution.execute(%(#{@nft_cmd} --version))[%r{^.*v(\d+\.\d+.\d+)\s.*$}, 1]
     {
-      'tables'  => tables,
+      'tables' => tables,
       'version' => version,
     }
   end
diff --git a/spec/acceptance/all_rules_spec.rb b/spec/acceptance/all_rules_spec.rb
index 45f6880..47112e3 100644
--- a/spec/acceptance/all_rules_spec.rb
+++ b/spec/acceptance/all_rules_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper_acceptance'
 
 describe 'nftables class' do
diff --git a/spec/acceptance/default_spec.rb b/spec/acceptance/default_spec.rb
index 716e791..d534921 100644
--- a/spec/acceptance/default_spec.rb
+++ b/spec/acceptance/default_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper_acceptance'
 
 describe 'nftables class' do
@@ -50,6 +52,7 @@ describe 'nftables class' do
       it { is_expected.to be_directory }
     end
   end
+
   context 'with bad invalid nft rules' do
     it 'puppet fails but should leave nft service running' do
       pp = <<-EOS
@@ -76,11 +79,13 @@ describe 'nftables class' do
       EOS
       apply_manifest(pp, expect_failures: true)
     end
+
     describe service('nftables') do
       it { is_expected.to be_running }
       it { is_expected.to be_enabled }
     end
   end
+
   context 'with totally empty firewall' do
     it 'no rules validate okay' do
       pp = <<-EOS
@@ -106,11 +111,13 @@ describe 'nftables class' do
       EOS
       apply_manifest(pp, catch_failures: true)
     end
+
     describe service('nftables') do
       it { is_expected.to be_running }
       it { is_expected.to be_enabled }
     end
   end
+
   context 'with custom nat_table_name' do
     it 'no rules validate okay' do
       pp = <<-EOS
@@ -136,6 +143,7 @@ describe 'nftables class' do
       EOS
       apply_manifest(pp, catch_failures: true)
     end
+
     describe service('nftables') do
       it { is_expected.to be_running }
       it { is_expected.to be_enabled }
diff --git a/spec/classes/bridges_spec.rb b/spec/classes/bridges_spec.rb
index bf467dc..0b0bab0 100644
--- a/spec/classes/bridges_spec.rb
+++ b/spec/classes/bridges_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables' do
@@ -22,15 +24,16 @@ describe 'nftables' do
         it { is_expected.not_to contain_nftables__rule('default_fwd-bridge_lo_lo') }
 
         it {
-          is_expected.to contain_nftables__rule('default_fwd-bridge_br0_br0').with(
+          expect(subject).to contain_nftables__rule('default_fwd-bridge_br0_br0').with(
             order: '08',
             content: 'iifname br0 oifname br0 accept'
           )
         }
 
         it { is_expected.to contain_nftables__rule('default_fwd-bridge_br1_br1') }
+
         it {
-          is_expected.to contain_nftables__rule('default_fwd-bridge_br1_br1').with(
+          expect(subject).to contain_nftables__rule('default_fwd-bridge_br1_br1').with(
             order: '08',
             content: 'iifname br1 oifname br1 accept'
           )
diff --git a/spec/classes/dnat4_spec.rb b/spec/classes/dnat4_spec.rb
index d68c2e6..e8b7124 100644
--- a/spec/classes/dnat4_spec.rb
+++ b/spec/classes/dnat4_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables' do
@@ -51,142 +53,158 @@ describe 'nftables' do
         it { is_expected.to compile }
 
         it {
-          is_expected.to contain_concat('nftables-inet-filter-chain-default_fwd').with(
-            path:           '/etc/nftables/puppet-preflight/inet-filter-chain-default_fwd.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-inet-filter-chain-default_fwd').with(
+            path: '/etc/nftables/puppet-preflight/inet-filter-chain-default_fwd.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-header').with(
-            target:  'nftables-inet-filter-chain-default_fwd',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-header').with(
+            target: 'nftables-inet-filter-chain-default_fwd',
             content: %r{^chain default_fwd \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-rule-jump_ingoing').with(
-            target:  'nftables-inet-filter-chain-default_fwd',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-rule-jump_ingoing').with(
+            target: 'nftables-inet-filter-chain-default_fwd',
             content: %r{^  iifname eth0 oifname eth1 jump ingoing$},
-            order:   '20-nftables-inet-filter-chain-default_fwd-rule-jump_ingoing-b'
+            order: '20-nftables-inet-filter-chain-default_fwd-rule-jump_ingoing-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-footer').with(
-            target:  'nftables-inet-filter-chain-default_fwd',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-footer').with(
+            target: 'nftables-inet-filter-chain-default_fwd',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
 
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-header').with(
-            target:  'nftables-inet-filter-chain-ingoing',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-ingoing-header').with(
+            target: 'nftables-inet-filter-chain-ingoing',
             content: %r{^chain ingoing \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-http').with(
-            target:  'nftables-inet-filter-chain-ingoing',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-http').with(
+            target: 'nftables-inet-filter-chain-ingoing',
             content: %r{^  ip daddr 192.0.2.2 tcp dport http accept$},
-            order:   '10-nftables-inet-filter-chain-ingoing-rule-http-b'
+            order: '10-nftables-inet-filter-chain-ingoing-rule-http-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-https').with(
-            target:  'nftables-inet-filter-chain-ingoing',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-https').with(
+            target: 'nftables-inet-filter-chain-ingoing',
             content: %r{^  ip daddr 192.0.2.2 tcp dport https accept$},
-            order:   '10-nftables-inet-filter-chain-ingoing-rule-https-b'
+            order: '10-nftables-inet-filter-chain-ingoing-rule-https-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-http_alt').with(
-            target:  'nftables-inet-filter-chain-ingoing',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-http_alt').with(
+            target: 'nftables-inet-filter-chain-ingoing',
             content: %r{^  iifname eth0 ip daddr 192.0.2.2 tcp dport 8000 accept$},
-            order:   '10-nftables-inet-filter-chain-ingoing-rule-http_alt-b'
+            order: '10-nftables-inet-filter-chain-ingoing-rule-http_alt-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-wireguard').with(
-            target:  'nftables-inet-filter-chain-ingoing',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-wireguard').with(
+            target: 'nftables-inet-filter-chain-ingoing',
             content: %r{^  iifname eth0 ip daddr 192.0.2.3 udp dport 51820 accept$},
-            order:   '10-nftables-inet-filter-chain-ingoing-rule-wireguard-b'
+            order: '10-nftables-inet-filter-chain-ingoing-rule-wireguard-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-footer').with(
-            target:  'nftables-inet-filter-chain-ingoing',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-ingoing-footer').with(
+            target: 'nftables-inet-filter-chain-ingoing',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
 
         it {
-          is_expected.to contain_concat('nftables-ip-nat-chain-PREROUTING').with(
-            path:           '/etc/nftables/puppet-preflight/ip-nat-chain-PREROUTING.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-ip-nat-chain-PREROUTING').with(
+            path: '/etc/nftables/puppet-preflight/ip-nat-chain-PREROUTING.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-header').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-header').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^chain PREROUTING \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-type').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-type').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  type nat hook prerouting priority -100$},
-            order:   '01-nftables-ip-nat-chain-PREROUTING-rule-type-b'
+            order: '01-nftables-ip-nat-chain-PREROUTING-rule-type-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-policy').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-policy').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  policy accept$},
-            order:   '02-nftables-ip-nat-chain-PREROUTING-rule-policy-b'
+            order: '02-nftables-ip-nat-chain-PREROUTING-rule-policy-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-http').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-http').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  tcp dport http dnat to 192.0.2.2$},
-            order:   '10-nftables-ip-nat-chain-PREROUTING-rule-http-b'
+            order: '10-nftables-ip-nat-chain-PREROUTING-rule-http-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-https').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-https').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  tcp dport https dnat to 192.0.2.2$},
-            order:   '10-nftables-ip-nat-chain-PREROUTING-rule-https-b'
+            order: '10-nftables-ip-nat-chain-PREROUTING-rule-https-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-http_alt').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-http_alt').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  iifname eth0 tcp dport 8080 dnat to 192.0.2.2:8000$},
-            order:   '10-nftables-ip-nat-chain-PREROUTING-rule-http_alt-b'
+            order: '10-nftables-ip-nat-chain-PREROUTING-rule-http_alt-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-wireguard').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-wireguard').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  iifname eth0 udp dport 51820 dnat to 192.0.2.3$},
-            order:   '10-nftables-ip-nat-chain-PREROUTING-rule-wireguard-b'
+            order: '10-nftables-ip-nat-chain-PREROUTING-rule-wireguard-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-footer').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-footer').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
       end
diff --git a/spec/classes/inet_filter_spec.rb b/spec/classes/inet_filter_spec.rb
index b083dfd..fd79499 100644
--- a/spec/classes/inet_filter_spec.rb
+++ b/spec/classes/inet_filter_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables' do
@@ -10,425 +12,472 @@ describe 'nftables' do
       it { is_expected.to compile }
 
       it {
-        is_expected.to contain_concat('nftables-inet-filter').with(
-          path:   '/etc/nftables/puppet-preflight/inet-filter.nft',
+        expect(subject).to contain_concat('nftables-inet-filter').with(
+          path: '/etc/nftables/puppet-preflight/inet-filter.nft',
           ensure: 'present',
-          owner:  'root',
-          group:  'root',
-          mode:   '0640'
+          owner: 'root',
+          group: 'root',
+          mode: '0640'
         )
       }
 
       it {
-        is_expected.to contain_concat__fragment('nftables-inet-filter-header').with(
-          target:  'nftables-inet-filter',
+        expect(subject).to contain_concat__fragment('nftables-inet-filter-header').with(
+          target: 'nftables-inet-filter',
           content: %r{^table inet filter \{$},
-          order:   '00'
+          order: '00'
         )
       }
 
       it {
-        is_expected.to contain_concat__fragment('nftables-inet-filter-body').with(
-          target:  'nftables-inet-filter',
-          order:   '98'
+        expect(subject).to contain_concat__fragment('nftables-inet-filter-body').with(
+          target: 'nftables-inet-filter',
+          order: '98'
         )
       }
 
       it {
-        is_expected.to contain_concat__fragment('nftables-inet-filter-footer').with(
-          target:  'nftables-inet-filter',
+        expect(subject).to contain_concat__fragment('nftables-inet-filter-footer').with(
+          target: 'nftables-inet-filter',
           content: %r{^\}$},
-          order:   '99'
+          order: '99'
         )
       }
 
       context 'chain input' do
         it {
-          is_expected.to contain_concat('nftables-inet-filter-chain-INPUT').with(
-            path:           '/etc/nftables/puppet-preflight/inet-filter-chain-INPUT.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-inet-filter-chain-INPUT').with(
+            path: '/etc/nftables/puppet-preflight/inet-filter-chain-INPUT.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-header').with(
-            target:  'nftables-inet-filter-chain-INPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-header').with(
+            target: 'nftables-inet-filter-chain-INPUT',
             content: %r{^chain INPUT \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-type').with(
-            target:  'nftables-inet-filter-chain-INPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-type').with(
+            target: 'nftables-inet-filter-chain-INPUT',
             content: %r{^  type filter hook input priority 0$},
-            order:   '01-nftables-inet-filter-chain-INPUT-rule-type-b'
+            order: '01-nftables-inet-filter-chain-INPUT-rule-type-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-policy').with(
-            target:  'nftables-inet-filter-chain-INPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-policy').with(
+            target: 'nftables-inet-filter-chain-INPUT',
             content: %r{^  policy drop$},
-            order:   '02-nftables-inet-filter-chain-INPUT-rule-policy-b'
+            order: '02-nftables-inet-filter-chain-INPUT-rule-policy-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-lo').with(
-            target:  'nftables-inet-filter-chain-INPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-lo').with(
+            target: 'nftables-inet-filter-chain-INPUT',
             content: %r{^  iifname lo accept$},
-            order:   '03-nftables-inet-filter-chain-INPUT-rule-lo-b'
+            order: '03-nftables-inet-filter-chain-INPUT-rule-lo-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-jump_global').with(
-            target:  'nftables-inet-filter-chain-INPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-jump_global').with(
+            target: 'nftables-inet-filter-chain-INPUT',
             content: %r{^  jump global$},
-            order:   '04-nftables-inet-filter-chain-INPUT-rule-jump_global-b'
+            order: '04-nftables-inet-filter-chain-INPUT-rule-jump_global-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-accept_established_related').with(
-            target:  'nftables-inet-filter-chain-INPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-accept_established_related').with(
+            target: 'nftables-inet-filter-chain-INPUT',
             content: %r{^  ct state established,related accept$},
-            order:   '05-nftables-inet-filter-chain-INPUT-rule-accept_established_related-b'
+            order: '05-nftables-inet-filter-chain-INPUT-rule-accept_established_related-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-drop_invalid').with(
-            target:  'nftables-inet-filter-chain-INPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-drop_invalid').with(
+            target: 'nftables-inet-filter-chain-INPUT',
             content: %r{^  ct state invalid drop$},
-            order:   '06-nftables-inet-filter-chain-INPUT-rule-drop_invalid-b'
+            order: '06-nftables-inet-filter-chain-INPUT-rule-drop_invalid-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-jump_default_in').with(
-            target:  'nftables-inet-filter-chain-INPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-jump_default_in').with(
+            target: 'nftables-inet-filter-chain-INPUT',
             content: %r{^  jump default_in$},
-            order:   '10-nftables-inet-filter-chain-INPUT-rule-jump_default_in-b'
+            order: '10-nftables-inet-filter-chain-INPUT-rule-jump_default_in-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-INPUT',
-            content: %r{^  limit rate 3/minute burst 5 packets log prefix \"\[nftables\] INPUT Rejected: \" flags all counter$},
-            order:   '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-INPUT',
+            content: %r{^  limit rate 3/minute burst 5 packets log prefix "\[nftables\] INPUT Rejected: " flags all counter$},
+            order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-reject').with(
-            target:  'nftables-inet-filter-chain-INPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-reject').with(
+            target: 'nftables-inet-filter-chain-INPUT',
             content: %r{^  reject with icmpx type port-unreachable$},
-            order:   '98-nftables-inet-filter-chain-INPUT-rule-reject-b'
+            order: '98-nftables-inet-filter-chain-INPUT-rule-reject-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-footer').with(
-            target:  'nftables-inet-filter-chain-INPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-footer').with(
+            target: 'nftables-inet-filter-chain-INPUT',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
 
         it {
-          is_expected.to contain_concat('nftables-inet-filter-chain-default_in').with(
-            path:           '/etc/nftables/puppet-preflight/inet-filter-chain-default_in.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-inet-filter-chain-default_in').with(
+            path: '/etc/nftables/puppet-preflight/inet-filter-chain-default_in.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_in-header').with(
-            target:  'nftables-inet-filter-chain-default_in',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_in-header').with(
+            target: 'nftables-inet-filter-chain-default_in',
             content: %r{^chain default_in \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_in-footer').with(
-            target:  'nftables-inet-filter-chain-default_in',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_in-footer').with(
+            target: 'nftables-inet-filter-chain-default_in',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_in-rule-ssh').with(
-            target:  'nftables-inet-filter-chain-default_in',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_in-rule-ssh').with(
+            target: 'nftables-inet-filter-chain-default_in',
             content: %r{^  tcp dport \{22\} accept$},
-            order:   '50-nftables-inet-filter-chain-default_in-rule-ssh-b'
+            order: '50-nftables-inet-filter-chain-default_in-rule-ssh-b'
           )
         }
+
         it {
-          is_expected.to contain_class('nftables::rules::icmp')
+          expect(subject).to contain_class('nftables::rules::icmp')
         }
       end
 
       context 'chain output' do
         it {
-          is_expected.to contain_concat('nftables-inet-filter-chain-OUTPUT').with(
-            path:           '/etc/nftables/puppet-preflight/inet-filter-chain-OUTPUT.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-inet-filter-chain-OUTPUT').with(
+            path: '/etc/nftables/puppet-preflight/inet-filter-chain-OUTPUT.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-header').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-header').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
             content: %r{^chain OUTPUT \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-type').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-type').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
             content: %r{^  type filter hook output priority 0$},
-            order:   '01-nftables-inet-filter-chain-OUTPUT-rule-type-b'
+            order: '01-nftables-inet-filter-chain-OUTPUT-rule-type-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-policy').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-policy').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
             content: %r{^  policy drop$},
-            order:   '02-nftables-inet-filter-chain-OUTPUT-rule-policy-b'
+            order: '02-nftables-inet-filter-chain-OUTPUT-rule-policy-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-lo').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-lo').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
             content: %r{^  oifname lo accept$},
-            order:   '03-nftables-inet-filter-chain-OUTPUT-rule-lo-b'
+            order: '03-nftables-inet-filter-chain-OUTPUT-rule-lo-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-jump_global').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-jump_global').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
             content: %r{^  jump global$},
-            order:   '04-nftables-inet-filter-chain-OUTPUT-rule-jump_global-b'
+            order: '04-nftables-inet-filter-chain-OUTPUT-rule-jump_global-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-accept_established_related').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-accept_established_related').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
             content: %r{^  ct state established,related accept$},
-            order:   '05-nftables-inet-filter-chain-OUTPUT-rule-accept_established_related-b'
+            order: '05-nftables-inet-filter-chain-OUTPUT-rule-accept_established_related-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-drop_invalid').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-drop_invalid').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
             content: %r{^  ct state invalid drop$},
-            order:   '06-nftables-inet-filter-chain-OUTPUT-rule-drop_invalid-b'
+            order: '06-nftables-inet-filter-chain-OUTPUT-rule-drop_invalid-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-jump_default_out').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-jump_default_out').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
             content: %r{^  jump default_out$},
-            order:   '10-nftables-inet-filter-chain-OUTPUT-rule-jump_default_out-b'
+            order: '10-nftables-inet-filter-chain-OUTPUT-rule-jump_default_out-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
-            content: %r{^  limit rate 3/minute burst 5 packets log prefix \"\[nftables\] OUTPUT Rejected: \" flags all counter$},
-            order:   '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
+            content: %r{^  limit rate 3/minute burst 5 packets log prefix "\[nftables\] OUTPUT Rejected: " flags all counter$},
+            order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-reject').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-reject').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
             content: %r{^  reject with icmpx type port-unreachable$},
-            order:   '98-nftables-inet-filter-chain-OUTPUT-rule-reject-b'
+            order: '98-nftables-inet-filter-chain-OUTPUT-rule-reject-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-footer').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-footer').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
 
         it {
-          is_expected.to contain_concat('nftables-inet-filter-chain-default_out').with(
-            path:           '/etc/nftables/puppet-preflight/inet-filter-chain-default_out.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-inet-filter-chain-default_out').with(
+            path: '/etc/nftables/puppet-preflight/inet-filter-chain-default_out.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-header').with(
-            target:  'nftables-inet-filter-chain-default_out',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_out-header').with(
+            target: 'nftables-inet-filter-chain-default_out',
             content: %r{^chain default_out \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-footer').with(
-            target:  'nftables-inet-filter-chain-default_out',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_out-footer').with(
+            target: 'nftables-inet-filter-chain-default_out',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnsudp').with(
-            target:  'nftables-inet-filter-chain-default_out',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnsudp').with(
+            target: 'nftables-inet-filter-chain-default_out',
             content: %r{^  udp dport 53 accept$},
-            order:   '50-nftables-inet-filter-chain-default_out-rule-dnsudp-b'
+            order: '50-nftables-inet-filter-chain-default_out-rule-dnsudp-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnstcp').with(
-            target:  'nftables-inet-filter-chain-default_out',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnstcp').with(
+            target: 'nftables-inet-filter-chain-default_out',
             content: %r{^  tcp dport 53 accept$},
-            order:   '50-nftables-inet-filter-chain-default_out-rule-dnstcp-b'
+            order: '50-nftables-inet-filter-chain-default_out-rule-dnstcp-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-chrony').with(
-            target:  'nftables-inet-filter-chain-default_out',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-chrony').with(
+            target: 'nftables-inet-filter-chain-default_out',
             content: %r{^  udp dport 123 accept$},
-            order:   '50-nftables-inet-filter-chain-default_out-rule-chrony-b'
+            order: '50-nftables-inet-filter-chain-default_out-rule-chrony-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-http').with(
-            target:  'nftables-inet-filter-chain-default_out',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-http').with(
+            target: 'nftables-inet-filter-chain-default_out',
             content: %r{^  tcp dport 80 accept$},
-            order:   '50-nftables-inet-filter-chain-default_out-rule-http-b'
+            order: '50-nftables-inet-filter-chain-default_out-rule-http-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-https').with(
-            target:  'nftables-inet-filter-chain-default_out',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-https').with(
+            target: 'nftables-inet-filter-chain-default_out',
             content: %r{^  tcp dport 443 accept$},
-            order:   '50-nftables-inet-filter-chain-default_out-rule-https-b'
+            order: '50-nftables-inet-filter-chain-default_out-rule-https-b'
           )
         }
+
         it {
-          is_expected.to contain_class('nftables::rules::out::icmp')
+          expect(subject).to contain_class('nftables::rules::out::icmp')
         }
       end
 
       context 'chain forward' do
         it {
-          is_expected.to contain_concat('nftables-inet-filter-chain-FORWARD').with(
-            path:           '/etc/nftables/puppet-preflight/inet-filter-chain-FORWARD.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-inet-filter-chain-FORWARD').with(
+            path: '/etc/nftables/puppet-preflight/inet-filter-chain-FORWARD.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-header').with(
-            target:  'nftables-inet-filter-chain-FORWARD',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-header').with(
+            target: 'nftables-inet-filter-chain-FORWARD',
             content: %r{^chain FORWARD \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-type').with(
-            target:  'nftables-inet-filter-chain-FORWARD',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-type').with(
+            target: 'nftables-inet-filter-chain-FORWARD',
             content: %r{^  type filter hook forward priority 0$},
-            order:   '01-nftables-inet-filter-chain-FORWARD-rule-type-b'
+            order: '01-nftables-inet-filter-chain-FORWARD-rule-type-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-policy').with(
-            target:  'nftables-inet-filter-chain-FORWARD',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-policy').with(
+            target: 'nftables-inet-filter-chain-FORWARD',
             content: %r{^  policy drop$},
-            order:   '02-nftables-inet-filter-chain-FORWARD-rule-policy-b'
+            order: '02-nftables-inet-filter-chain-FORWARD-rule-policy-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-jump_global').with(
-            target:  'nftables-inet-filter-chain-FORWARD',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-jump_global').with(
+            target: 'nftables-inet-filter-chain-FORWARD',
             content: %r{^  jump global$},
-            order:   '03-nftables-inet-filter-chain-FORWARD-rule-jump_global-b'
+            order: '03-nftables-inet-filter-chain-FORWARD-rule-jump_global-b'
           )
         }
+
         it {
-          is_expected.not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-accept_established_related')
+          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-accept_established_related')
         }
+
         it {
-          is_expected.not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-drop_invalid')
+          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-drop_invalid')
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-jump_default_fwd').with(
-            target:  'nftables-inet-filter-chain-FORWARD',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-jump_default_fwd').with(
+            target: 'nftables-inet-filter-chain-FORWARD',
             content: %r{^  jump default_fwd$},
-            order:   '10-nftables-inet-filter-chain-FORWARD-rule-jump_default_fwd-b'
+            order: '10-nftables-inet-filter-chain-FORWARD-rule-jump_default_fwd-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-FORWARD',
-            content: %r{^  limit rate 3/minute burst 5 packets log prefix \"\[nftables\] FORWARD Rejected: \" flags all counter$},
-            order:   '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-FORWARD',
+            content: %r{^  limit rate 3/minute burst 5 packets log prefix "\[nftables\] FORWARD Rejected: " flags all counter$},
+            order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-reject').with(
-            target:  'nftables-inet-filter-chain-FORWARD',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-reject').with(
+            target: 'nftables-inet-filter-chain-FORWARD',
             content: %r{^  reject with icmpx type port-unreachable$},
-            order:   '98-nftables-inet-filter-chain-FORWARD-rule-reject-b'
+            order: '98-nftables-inet-filter-chain-FORWARD-rule-reject-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-footer').with(
-            target:  'nftables-inet-filter-chain-FORWARD',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-footer').with(
+            target: 'nftables-inet-filter-chain-FORWARD',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
 
         it {
-          is_expected.to contain_concat('nftables-inet-filter-chain-default_fwd').with(
-            path:           '/etc/nftables/puppet-preflight/inet-filter-chain-default_fwd.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-inet-filter-chain-default_fwd').with(
+            path: '/etc/nftables/puppet-preflight/inet-filter-chain-default_fwd.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-header').with(
-            target:  'nftables-inet-filter-chain-default_fwd',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-header').with(
+            target: 'nftables-inet-filter-chain-default_fwd',
             content: %r{^chain default_fwd \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-footer').with(
-            target:  'nftables-inet-filter-chain-default_fwd',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-footer').with(
+            target: 'nftables-inet-filter-chain-default_fwd',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
       end
 
       context 'chain global' do
         it {
-          is_expected.to contain_concat('nftables-inet-filter-chain-global').with(
-            path:           '/etc/nftables/puppet-preflight/inet-filter-chain-global.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-inet-filter-chain-global').with(
+            path: '/etc/nftables/puppet-preflight/inet-filter-chain-global.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-global-header').with(
-            target:  'nftables-inet-filter-chain-global',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-global-header').with(
+            target: 'nftables-inet-filter-chain-global',
             content: %r{^chain global \{$},
-            order:   '00'
+            order: '00'
           )
         }
       end
@@ -437,24 +486,26 @@ describe 'nftables' do
         let(:pre_condition) { 'class{\'nftables\': log_prefix => "test "}' }
 
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-INPUT',
-            content: %r{^  limit rate 3/minute burst 5 packets log prefix \"test " flags all counter$},
-            order:   '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-INPUT',
+            content: %r{^  limit rate 3/minute burst 5 packets log prefix "test " flags all counter$},
+            order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
-            content: %r{^  limit rate 3/minute burst 5 packets log prefix \"test " flags all counter$},
-            order:   '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
+            content: %r{^  limit rate 3/minute burst 5 packets log prefix "test " flags all counter$},
+            order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-FORWARD',
-            content: %r{^  limit rate 3/minute burst 5 packets log prefix \"test " flags all counter$},
-            order:   '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-FORWARD',
+            content: %r{^  limit rate 3/minute burst 5 packets log prefix "test " flags all counter$},
+            order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b'
           )
         }
       end
@@ -463,24 +514,26 @@ describe 'nftables' do
         let(:pre_condition) { 'class{\'nftables\': log_prefix => " bar [%<chain>s] "}' }
 
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-INPUT',
-            content: %r{^  limit rate 3/minute burst 5 packets log prefix \" bar \[INPUT\] " flags all counter$},
-            order:   '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-INPUT',
+            content: %r{^  limit rate 3/minute burst 5 packets log prefix " bar \[INPUT\] " flags all counter$},
+            order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
-            content: %r{^  limit rate 3/minute burst 5 packets log prefix \" bar \[OUTPUT\] " flags all counter$},
-            order:   '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
+            content: %r{^  limit rate 3/minute burst 5 packets log prefix " bar \[OUTPUT\] " flags all counter$},
+            order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-FORWARD',
-            content: %r{^  limit rate 3/minute burst 5 packets log prefix \" bar \[FORWARD\] " flags all counter$},
-            order:   '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-FORWARD',
+            content: %r{^  limit rate 3/minute burst 5 packets log prefix " bar \[FORWARD\] " flags all counter$},
+            order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b'
           )
         }
       end
@@ -493,24 +546,26 @@ describe 'nftables' do
         end
 
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-INPUT',
-            content: %r{^  log prefix \"\[nftables\] INPUT Rejected: \" flags all counter$},
-            order:   '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-INPUT',
+            content: %r{^  log prefix "\[nftables\] INPUT Rejected: " flags all counter$},
+            order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
-            content: %r{^  log prefix \"\[nftables\] OUTPUT Rejected: \" flags all counter$},
-            order:   '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
+            content: %r{^  log prefix "\[nftables\] OUTPUT Rejected: " flags all counter$},
+            order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-FORWARD',
-            content: %r{^  log prefix \"\[nftables\] FORWARD Rejected: \" flags all counter$},
-            order:   '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-FORWARD',
+            content: %r{^  log prefix "\[nftables\] FORWARD Rejected: " flags all counter$},
+            order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b'
           )
         }
       end
@@ -523,24 +578,26 @@ describe 'nftables' do
         end
 
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-INPUT',
-            content: %r{^  limit rate 5/minute log prefix \"\[nftables\] INPUT Rejected: \" flags all counter$},
-            order:   '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-INPUT',
+            content: %r{^  limit rate 5/minute log prefix "\[nftables\] INPUT Rejected: " flags all counter$},
+            order: '97-nftables-inet-filter-chain-INPUT-rule-log_discarded-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
-            content: %r{^  limit rate 5/minute log prefix \"\[nftables\] OUTPUT Rejected: \" flags all counter$},
-            order:   '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
+            content: %r{^  limit rate 5/minute log prefix "\[nftables\] OUTPUT Rejected: " flags all counter$},
+            order: '97-nftables-inet-filter-chain-OUTPUT-rule-log_discarded-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
-            target:  'nftables-inet-filter-chain-FORWARD',
-            content: %r{^  limit rate 5/minute log prefix \"\[nftables\] FORWARD Rejected: \" flags all counter$},
-            order:   '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b'
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded').with(
+            target: 'nftables-inet-filter-chain-FORWARD',
+            content: %r{^  limit rate 5/minute log prefix "\[nftables\] FORWARD Rejected: " flags all counter$},
+            order: '97-nftables-inet-filter-chain-FORWARD-rule-log_discarded-b'
           )
         }
       end
@@ -553,22 +610,27 @@ describe 'nftables' do
         end
 
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded')
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_discarded')
         }
+
         it {
-          is_expected.not_to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-reject')
+          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-reject')
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded')
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_discarded')
         }
+
         it {
-          is_expected.not_to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-reject')
+          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-reject')
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded')
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_discarded')
         }
+
         it {
-          is_expected.not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-reject')
+          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-reject')
         }
       end
 
@@ -580,24 +642,26 @@ describe 'nftables' do
         end
 
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-reject').with(
-            target:  'nftables-inet-filter-chain-INPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-reject').with(
+            target: 'nftables-inet-filter-chain-INPUT',
             content: %r{^  reject with tcp reset$},
-            order:   '98-nftables-inet-filter-chain-INPUT-rule-reject-b'
+            order: '98-nftables-inet-filter-chain-INPUT-rule-reject-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-reject').with(
-            target:  'nftables-inet-filter-chain-OUTPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-reject').with(
+            target: 'nftables-inet-filter-chain-OUTPUT',
             content: %r{^  reject with tcp reset$},
-            order:   '98-nftables-inet-filter-chain-OUTPUT-rule-reject-b'
+            order: '98-nftables-inet-filter-chain-OUTPUT-rule-reject-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-reject').with(
-            target:  'nftables-inet-filter-chain-FORWARD',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-reject').with(
+            target: 'nftables-inet-filter-chain-FORWARD',
             content: %r{^  reject with tcp reset$},
-            order:   '98-nftables-inet-filter-chain-FORWARD-rule-reject-b'
+            order: '98-nftables-inet-filter-chain-FORWARD-rule-reject-b'
           )
         }
       end
@@ -616,27 +680,32 @@ describe 'nftables' do
         let(:params) do
           {
             'in_out_conntrack' => false,
-            'fwd_conntrack'    => false,
+            'fwd_conntrack' => false,
           }
         end
 
         it {
-          is_expected.not_to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-accept_established_related')
+          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-accept_established_related')
         }
+
         it {
-          is_expected.not_to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-drop_invalid')
+          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-drop_invalid')
         }
+
         it {
-          is_expected.not_to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-accept_established_related')
+          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-accept_established_related')
         }
+
         it {
-          is_expected.not_to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-drop_invalid')
+          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-drop_invalid')
         }
+
         it {
-          is_expected.not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-accept_established_related')
+          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-accept_established_related')
         }
+
         it {
-          is_expected.not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-drop_invalid')
+          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-drop_invalid')
         }
       end
 
@@ -649,10 +718,11 @@ describe 'nftables' do
         end
 
         it {
-          is_expected.not_to contain_class('nftables::rules::icmp')
+          expect(subject).not_to contain_class('nftables::rules::icmp')
         }
+
         it {
-          is_expected.not_to contain_class('nftables::rules::out::icmp')
+          expect(subject).not_to contain_class('nftables::rules::out::icmp')
         }
       end
     end
diff --git a/spec/classes/ip_nat_spec.rb b/spec/classes/ip_nat_spec.rb
index fb89c30..238176d 100644
--- a/spec/classes/ip_nat_spec.rb
+++ b/spec/classes/ip_nat_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables' do
@@ -10,229 +12,245 @@ describe 'nftables' do
       it { is_expected.to compile }
 
       it {
-        is_expected.to contain_concat('nftables-ip-nat').with(
-          path:   '/etc/nftables/puppet-preflight/ip-nat.nft',
+        expect(subject).to contain_concat('nftables-ip-nat').with(
+          path: '/etc/nftables/puppet-preflight/ip-nat.nft',
           ensure: 'present',
-          owner:  'root',
-          group:  'root',
-          mode:   '0640'
+          owner: 'root',
+          group: 'root',
+          mode: '0640'
         )
       }
 
       it {
-        is_expected.to contain_concat__fragment('nftables-ip-nat-header').with(
-          target:  'nftables-ip-nat',
+        expect(subject).to contain_concat__fragment('nftables-ip-nat-header').with(
+          target: 'nftables-ip-nat',
           content: %r{^table ip nat \{$},
-          order:   '00'
+          order: '00'
         )
       }
 
       it {
-        is_expected.to contain_concat__fragment('nftables-ip-nat-body').with(
-          target:  'nftables-ip-nat',
+        expect(subject).to contain_concat__fragment('nftables-ip-nat-body').with(
+          target: 'nftables-ip-nat',
           content: %r{^\s+include "ip-nat-chain-\*\.nft"$},
-          order:   '98'
+          order: '98'
         )
       }
 
       it {
-        is_expected.to contain_concat__fragment('nftables-ip-nat-footer').with(
-          target:  'nftables-ip-nat',
+        expect(subject).to contain_concat__fragment('nftables-ip-nat-footer').with(
+          target: 'nftables-ip-nat',
           content: %r{^\}$},
-          order:   '99'
+          order: '99'
         )
       }
 
       it {
-        is_expected.to contain_concat('nftables-ip6-nat').with(
-          path:   '/etc/nftables/puppet-preflight/ip6-nat.nft',
+        expect(subject).to contain_concat('nftables-ip6-nat').with(
+          path: '/etc/nftables/puppet-preflight/ip6-nat.nft',
           ensure: 'present',
-          owner:  'root',
-          group:  'root',
-          mode:   '0640'
+          owner: 'root',
+          group: 'root',
+          mode: '0640'
         )
       }
 
       it {
-        is_expected.to contain_concat__fragment('nftables-ip6-nat-header').with(
-          target:  'nftables-ip6-nat',
+        expect(subject).to contain_concat__fragment('nftables-ip6-nat-header').with(
+          target: 'nftables-ip6-nat',
           content: %r{^table ip6 nat \{$},
-          order:   '00'
+          order: '00'
         )
       }
 
       it {
-        is_expected.to contain_concat__fragment('nftables-ip6-nat-body').with(
-          target:  'nftables-ip6-nat',
+        expect(subject).to contain_concat__fragment('nftables-ip6-nat-body').with(
+          target: 'nftables-ip6-nat',
           content: %r{^\s+include "ip6-nat-chain-\*\.nft"$},
-          order:   '98'
+          order: '98'
         )
       }
 
       it {
-        is_expected.to contain_concat__fragment('nftables-ip6-nat-footer').with(
-          target:  'nftables-ip6-nat',
+        expect(subject).to contain_concat__fragment('nftables-ip6-nat-footer').with(
+          target: 'nftables-ip6-nat',
           content: %r{^\}$},
-          order:   '99'
+          order: '99'
         )
       }
 
       context 'table ip nat chain prerouting' do
         it {
-          is_expected.to contain_concat('nftables-ip-nat-chain-PREROUTING').with(
-            path:           '/etc/nftables/puppet-preflight/ip-nat-chain-PREROUTING.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-ip-nat-chain-PREROUTING').with(
+            path: '/etc/nftables/puppet-preflight/ip-nat-chain-PREROUTING.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-header').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-header').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^chain PREROUTING \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-type').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-type').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  type nat hook prerouting priority -100$},
-            order:   '01-nftables-ip-nat-chain-PREROUTING-rule-type-b'
+            order: '01-nftables-ip-nat-chain-PREROUTING-rule-type-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-policy').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-policy').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  policy accept$},
-            order:   '02-nftables-ip-nat-chain-PREROUTING-rule-policy-b'
+            order: '02-nftables-ip-nat-chain-PREROUTING-rule-policy-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-footer').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-footer').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
       end
 
       context 'table ip nat chain postrouting' do
         it {
-          is_expected.to contain_concat('nftables-ip-nat-chain-POSTROUTING').with(
-            path:           '/etc/nftables/puppet-preflight/ip-nat-chain-POSTROUTING.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-ip-nat-chain-POSTROUTING').with(
+            path: '/etc/nftables/puppet-preflight/ip-nat-chain-POSTROUTING.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-header').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-header').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^chain POSTROUTING \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  type nat hook postrouting priority 100$},
-            order:   '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b'
+            order: '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  policy accept$},
-            order:   '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b'
+            order: '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-footer').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-footer').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
       end
 
       context 'table ip6 nat chain prerouting' do
         it {
-          is_expected.to contain_concat('nftables-ip6-nat-chain-PREROUTING6').with(
-            path:           '/etc/nftables/puppet-preflight/ip6-nat-chain-PREROUTING6.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-ip6-nat-chain-PREROUTING6').with(
+            path: '/etc/nftables/puppet-preflight/ip6-nat-chain-PREROUTING6.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-header').with(
-            target:  'nftables-ip6-nat-chain-PREROUTING6',
+          expect(subject).to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-header').with(
+            target: 'nftables-ip6-nat-chain-PREROUTING6',
             content: %r{^chain PREROUTING6 \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-rule-type').with(
-            target:  'nftables-ip6-nat-chain-PREROUTING6',
+          expect(subject).to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-rule-type').with(
+            target: 'nftables-ip6-nat-chain-PREROUTING6',
             content: %r{^  type nat hook prerouting priority -100$},
-            order:   '01-nftables-ip6-nat-chain-PREROUTING6-rule-type-b'
+            order: '01-nftables-ip6-nat-chain-PREROUTING6-rule-type-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-rule-policy').with(
-            target:  'nftables-ip6-nat-chain-PREROUTING6',
+          expect(subject).to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-rule-policy').with(
+            target: 'nftables-ip6-nat-chain-PREROUTING6',
             content: %r{^  policy accept$},
-            order:   '02-nftables-ip6-nat-chain-PREROUTING6-rule-policy-b'
+            order: '02-nftables-ip6-nat-chain-PREROUTING6-rule-policy-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-footer').with(
-            target:  'nftables-ip6-nat-chain-PREROUTING6',
+          expect(subject).to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-footer').with(
+            target: 'nftables-ip6-nat-chain-PREROUTING6',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
       end
 
       context 'table ip nat chain postrouting' do
         it {
-          is_expected.to contain_concat('nftables-ip6-nat-chain-POSTROUTING6').with(
-            path:           '/etc/nftables/puppet-preflight/ip6-nat-chain-POSTROUTING6.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-ip6-nat-chain-POSTROUTING6').with(
+            path: '/etc/nftables/puppet-preflight/ip6-nat-chain-POSTROUTING6.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-header').with(
-            target:  'nftables-ip6-nat-chain-POSTROUTING6',
+          expect(subject).to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-header').with(
+            target: 'nftables-ip6-nat-chain-POSTROUTING6',
             content: %r{^chain POSTROUTING6 \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-rule-type').with(
-            target:  'nftables-ip6-nat-chain-POSTROUTING6',
+          expect(subject).to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-rule-type').with(
+            target: 'nftables-ip6-nat-chain-POSTROUTING6',
             content: %r{^  type nat hook postrouting priority 100$},
-            order:   '01-nftables-ip6-nat-chain-POSTROUTING6-rule-type-b'
+            order: '01-nftables-ip6-nat-chain-POSTROUTING6-rule-type-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-rule-policy').with(
-            target:  'nftables-ip6-nat-chain-POSTROUTING6',
+          expect(subject).to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-rule-policy').with(
+            target: 'nftables-ip6-nat-chain-POSTROUTING6',
             content: %r{^  policy accept$},
-            order:   '02-nftables-ip6-nat-chain-POSTROUTING6-rule-policy-b'
+            order: '02-nftables-ip6-nat-chain-POSTROUTING6-rule-policy-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-footer').with(
-            target:  'nftables-ip6-nat-chain-POSTROUTING6',
+          expect(subject).to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-footer').with(
+            target: 'nftables-ip6-nat-chain-POSTROUTING6',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
       end
@@ -245,13 +263,14 @@ describe 'nftables' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_concat('nftables-ip-mycustomtablename').with(
-            path:   '/etc/nftables/puppet-preflight/ip-mycustomtablename.nft',
+          expect(subject).to contain_concat('nftables-ip-mycustomtablename').with(
+            path: '/etc/nftables/puppet-preflight/ip-mycustomtablename.nft',
             ensure: 'present',
-            owner:  'root',
-            group:  'root',
-            mode:   '0640'
+            owner: 'root',
+            group: 'root',
+            mode: '0640'
           )
         }
       end
diff --git a/spec/classes/masquerade_spec.rb b/spec/classes/masquerade_spec.rb
index 297e0e2..c16a36d 100644
--- a/spec/classes/masquerade_spec.rb
+++ b/spec/classes/masquerade_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables' do
@@ -35,75 +37,84 @@ describe 'nftables' do
         it { is_expected.to compile }
 
         it {
-          is_expected.to contain_concat('nftables-ip-nat-chain-POSTROUTING').with(
-            path:           '/etc/nftables/puppet-preflight/ip-nat-chain-POSTROUTING.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-ip-nat-chain-POSTROUTING').with(
+            path: '/etc/nftables/puppet-preflight/ip-nat-chain-POSTROUTING.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-header').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-header').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^chain POSTROUTING \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  type nat hook postrouting priority 100$},
-            order:   '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b'
+            order: '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  policy accept$},
-            order:   '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b'
+            order: '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth0').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth0').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  oifname eth0 masquerade$},
-            order:   '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth0-b'
+            order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth0-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth1_vpn').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
-            content: %r{^  oifname eth1 ip saddr 192\.0\.2\.0\/24 masquerade$},
-            order:   '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth1_vpn-b'
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth1_vpn').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
+            content: %r{^  oifname eth1 ip saddr 192\.0\.2\.0/24 masquerade$},
+            order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth1_vpn-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
-            content: %r{^  ip saddr 192\.0\.2\.0\/24 ip daddr 198.51.100.2 tcp dport 22 masquerade$},
-            order:   '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh-b'
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
+            content: %r{^  ip saddr 192\.0\.2\.0/24 ip daddr 198.51.100.2 tcp dport 22 masquerade$},
+            order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh_gitlab').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
-            content: %r{^  ip saddr 192\.0\.2\.0\/24 ip daddr 198.51.100.2 tcp dport 22 masquerade$},
-            order:   '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh_gitlab-b'
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh_gitlab').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
+            content: %r{^  ip saddr 192\.0\.2\.0/24 ip daddr 198.51.100.2 tcp dport 22 masquerade$},
+            order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh_gitlab-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_wireguard').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_wireguard').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  udp dport 51820 masquerade$},
-            order:   '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_wireguard-b'
+            order: '70-nftables-ip-nat-chain-POSTROUTING-rule-masquerade_wireguard-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-footer').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-footer').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
       end
diff --git a/spec/classes/nftables_spec.rb b/spec/classes/nftables_spec.rb
index 8ddb91e..4b1edd0 100644
--- a/spec/classes/nftables_spec.rb
+++ b/spec/classes/nftables_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables' do
@@ -12,58 +14,58 @@ describe 'nftables' do
       it { is_expected.to contain_package('nftables') }
 
       it {
-        is_expected.to contain_file('/etc/nftables/puppet.nft').with(
+        expect(subject).to contain_file('/etc/nftables/puppet.nft').with(
           ensure: 'file',
-          owner:  'root',
-          group:  'root',
-          mode:   '0640',
+          owner: 'root',
+          group: 'root',
+          mode: '0640',
           content: %r{flush ruleset}
         )
       }
 
       it {
-        is_expected.to contain_file('/etc/nftables/puppet').with(
-          ensure:  'directory',
-          owner:   'root',
-          group:   'root',
-          mode:    '0750',
-          purge:   true,
-          force:   true,
+        expect(subject).to contain_file('/etc/nftables/puppet').with(
+          ensure: 'directory',
+          owner: 'root',
+          group: 'root',
+          mode: '0750',
+          purge: true,
+          force: true,
           recurse: true
         )
       }
 
       it {
-        is_expected.to contain_file('/etc/nftables/puppet-preflight.nft').with(
+        expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').with(
           ensure: 'file',
-          owner:  'root',
-          group:  'root',
-          mode:   '0640',
+          owner: 'root',
+          group: 'root',
+          mode: '0640',
           content: %r{flush ruleset}
         )
       }
 
       it {
-        is_expected.to contain_file('/etc/nftables/puppet-preflight').with(
-          ensure:  'directory',
-          owner:   'root',
-          group:   'root',
-          mode:    '0750',
-          purge:   true,
-          force:   true,
+        expect(subject).to contain_file('/etc/nftables/puppet-preflight').with(
+          ensure: 'directory',
+          owner: 'root',
+          group: 'root',
+          mode: '0750',
+          purge: true,
+          force: true,
           recurse: true
         )
       }
 
       it {
-        is_expected.to contain_exec('nft validate').with(
+        expect(subject).to contain_exec('nft validate').with(
           refreshonly: true,
           command: %r{^/usr/sbin/nft -I /etc/nftables/puppet-preflight -c -f /etc/nftables/puppet-preflight.nft.*}
         )
       }
 
       it {
-        is_expected.to contain_service('nftables').with(
+        expect(subject).to contain_service('nftables').with(
           ensure: 'running',
           enable: true,
           hasrestart: true,
@@ -72,17 +74,18 @@ describe 'nftables' do
       }
 
       it {
-        is_expected.to contain_systemd__dropin_file('puppet_nft.conf').with(
+        expect(subject).to contain_systemd__dropin_file('puppet_nft.conf').with(
           content: %r{^ExecReload=/sbin/nft -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf$}
         )
       }
 
       it {
-        is_expected.to contain_service('firewalld').with(
+        expect(subject).to contain_service('firewalld').with(
           ensure: 'stopped',
           enable: 'mask'
         )
       }
+
       it { is_expected.to contain_class('nftables::inet_filter') }
       it { is_expected.to contain_class('nftables::ip_nat') }
       it { is_expected.to contain_class('nftables::rules::out::http') }
@@ -121,10 +124,10 @@ describe 'nftables' do
         end
 
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-web_accept').with(
-            target:  'nftables-inet-filter-chain-INPUT',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-web_accept').with(
+            target: 'nftables-inet-filter-chain-INPUT',
             content: %r{^  iifname eth0 tcp dport \{ 80, 443 \} accept$},
-            order:   '50-nftables-inet-filter-chain-INPUT-rule-web_accept-b'
+            order: '50-nftables-inet-filter-chain-INPUT-rule-web_accept-b'
           )
         }
       end
@@ -146,14 +149,15 @@ describe 'nftables' do
         end
 
         it {
-          is_expected.to contain_nftables__set('testset1').with(
+          expect(subject).to contain_nftables__set('testset1').with(
             type: 'ipv4_addr',
             gc_interval: 2,
             table: 'inet-filter'
           )
         }
+
         it {
-          is_expected.to contain_nftables__set('testset2').with(
+          expect(subject).to contain_nftables__set('testset2').with(
             type: 'ipv6_addr',
             elements: ['2a02:62:c601::dead:beef'],
             table: 'inet-filter'
@@ -169,7 +173,7 @@ describe 'nftables' do
         end
 
         it {
-          is_expected.to contain_service('firewalld').with(
+          expect(subject).to contain_service('firewalld').with(
             ensure: 'stopped',
             enable: false
           )
@@ -216,37 +220,42 @@ describe 'nftables' do
 
         context 'with nftables fact matching' do
           let(:facts) do
-            super().merge(nftables: { tables: ['inet-abc', 'inet-f2b-table'] })
+            super().merge(nftables: { tables: %w[inet-abc inet-f2b-table] })
           end
 
           it {
-            is_expected.to contain_file('/etc/nftables/puppet-preflight.nft').
+            expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
               with_content(%r{^table inet abc \{\}$})
           }
+
           it {
-            is_expected.to contain_file('/etc/nftables/puppet-preflight.nft').
+            expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
               with_content(%r{^flush table inet abc$})
           }
         end
+
         context 'with nftables fact not matching' do
           let(:facts) do
-            super().merge(nftables: { tables: ['inet-abc', 'inet-ijk'] })
+            super().merge(nftables: { tables: %w[inet-abc inet-ijk] })
           end
 
           it {
-            is_expected.to contain_file('/etc/nftables/puppet-preflight.nft').
+            expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
               with_content(%r{^table inet abc \{\}$})
           }
+
           it {
-            is_expected.to contain_file('/etc/nftables/puppet-preflight.nft').
+            expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
               with_content(%r{^flush table inet abc$})
           }
+
           it {
-            is_expected.to contain_file('/etc/nftables/puppet-preflight.nft').
+            expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
               with_content(%r{^table inet ijk \{\}$})
           }
+
           it {
-            is_expected.to contain_file('/etc/nftables/puppet-preflight.nft').
+            expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
               with_content(%r{^flush table inet ijk$})
           }
         end
diff --git a/spec/classes/router_spec.rb b/spec/classes/router_spec.rb
index 9021def..cdb79c9 100644
--- a/spec/classes/router_spec.rb
+++ b/spec/classes/router_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables' do
@@ -31,123 +33,136 @@ describe 'nftables' do
         it { is_expected.to compile }
 
         it {
-          is_expected.to contain_concat('nftables-inet-filter-chain-default_fwd').with(
-            path:           '/etc/nftables/puppet-preflight/inet-filter-chain-default_fwd.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-inet-filter-chain-default_fwd').with(
+            path: '/etc/nftables/puppet-preflight/inet-filter-chain-default_fwd.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-header').with(
-            target:  'nftables-inet-filter-chain-default_fwd',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-header').with(
+            target: 'nftables-inet-filter-chain-default_fwd',
             content: %r{^chain default_fwd \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-rule-out').with(
-            target:  'nftables-inet-filter-chain-default_fwd',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-rule-out').with(
+            target: 'nftables-inet-filter-chain-default_fwd',
             content: %r{^  iifname eth1 oifname eth0 accept$},
-            order:   '20-nftables-inet-filter-chain-default_fwd-rule-out-b'
+            order: '20-nftables-inet-filter-chain-default_fwd-rule-out-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-rule-drop').with(
-            target:  'nftables-inet-filter-chain-default_fwd',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-rule-drop').with(
+            target: 'nftables-inet-filter-chain-default_fwd',
             content: %r{^  iifname eth0 drop$},
-            order:   '90-nftables-inet-filter-chain-default_fwd-rule-drop-b'
+            order: '90-nftables-inet-filter-chain-default_fwd-rule-drop-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-footer').with(
-            target:  'nftables-inet-filter-chain-default_fwd',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-footer').with(
+            target: 'nftables-inet-filter-chain-default_fwd',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
 
         it {
-          is_expected.to contain_concat('nftables-ip-nat-chain-PREROUTING').with(
-            path:           '/etc/nftables/puppet-preflight/ip-nat-chain-PREROUTING.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-ip-nat-chain-PREROUTING').with(
+            path: '/etc/nftables/puppet-preflight/ip-nat-chain-PREROUTING.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-header').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-header').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^chain PREROUTING \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-type').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-type').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  type nat hook prerouting priority -100$},
-            order:   '01-nftables-ip-nat-chain-PREROUTING-rule-type-b'
+            order: '01-nftables-ip-nat-chain-PREROUTING-rule-type-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-policy').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-policy').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  policy accept$},
-            order:   '02-nftables-ip-nat-chain-PREROUTING-rule-policy-b'
+            order: '02-nftables-ip-nat-chain-PREROUTING-rule-policy-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-footer').with(
-            target:  'nftables-ip-nat-chain-PREROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-footer').with(
+            target: 'nftables-ip-nat-chain-PREROUTING',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
 
         it {
-          is_expected.to contain_concat('nftables-ip-nat-chain-POSTROUTING').with(
-            path:           '/etc/nftables/puppet-preflight/ip-nat-chain-POSTROUTING.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-ip-nat-chain-POSTROUTING').with(
+            path: '/etc/nftables/puppet-preflight/ip-nat-chain-POSTROUTING.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-header').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-header').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^chain POSTROUTING \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  type nat hook postrouting priority 100$},
-            order:   '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b'
+            order: '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  policy accept$},
-            order:   '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b'
+            order: '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  oifname eth0 masquerade$},
-            order:   '20-nftables-ip-nat-chain-POSTROUTING-rule-masquerade-b'
+            order: '20-nftables-ip-nat-chain-POSTROUTING-rule-masquerade-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-footer').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-footer').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
       end
diff --git a/spec/classes/rules/activemq_spec.rb b/spec/classes/rules/activemq_spec.rb
index a9c09b7..9757945 100644
--- a/spec/classes/rules/activemq_spec.rb
+++ b/spec/classes/rules/activemq_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::activemq' do
diff --git a/spec/classes/rules/afs3_callback_spec.rb b/spec/classes/rules/afs3_callback_spec.rb
index 042d6f7..3cab80e 100644
--- a/spec/classes/rules/afs3_callback_spec.rb
+++ b/spec/classes/rules/afs3_callback_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::afs3_callback' do
diff --git a/spec/classes/rules/ceph_mon_spec.rb b/spec/classes/rules/ceph_mon_spec.rb
index a529f3a..7ccf240 100644
--- a/spec/classes/rules/ceph_mon_spec.rb
+++ b/spec/classes/rules/ceph_mon_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::ceph_mon' do
diff --git a/spec/classes/rules/ceph_spec.rb b/spec/classes/rules/ceph_spec.rb
index 59f36f4..0ca40f8 100644
--- a/spec/classes/rules/ceph_spec.rb
+++ b/spec/classes/rules/ceph_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::ceph' do
diff --git a/spec/classes/rules/dns_spec.rb b/spec/classes/rules/dns_spec.rb
index 6176ebb..58d9f2b 100644
--- a/spec/classes/rules/dns_spec.rb
+++ b/spec/classes/rules/dns_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::dns' do
diff --git a/spec/classes/rules/docker_ce_spec.rb b/spec/classes/rules/docker_ce_spec.rb
index c0c2629..ee57308 100644
--- a/spec/classes/rules/docker_ce_spec.rb
+++ b/spec/classes/rules/docker_ce_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::docker_ce' do
@@ -14,24 +16,28 @@ describe 'nftables::rules::docker_ce' do
         it { is_expected.to contain_nftables__chain('DOCKER_ISOLATION_STAGE_1') }
         it { is_expected.to contain_nftables__chain('DOCKER_ISOLATION_STAGE_2') }
         it { is_expected.to contain_nftables__chain('DOCKER_USER') }
+
         it {
-          is_expected.to contain_nftables__chain('DOCKER-nat').with(
+          expect(subject).to contain_nftables__chain('DOCKER-nat').with(
             chain: 'DOCKER',
             table: 'ip-nat'
           )
         }
+
         it {
-          is_expected.to contain_nftables__chain('OUTPUT-nat').with(
+          expect(subject).to contain_nftables__chain('OUTPUT-nat').with(
             chain: 'OUTPUT',
             table: 'ip-nat'
           )
         }
+
         it {
-          is_expected.to contain_nftables__chain('INPUT-nat').with(
+          expect(subject).to contain_nftables__chain('INPUT-nat').with(
             chain: 'INPUT',
             table: 'ip-nat'
           )
         }
+
         it { is_expected.to contain_nftables__rule('DOCKER_ISOLATION_STAGE_1-iifname').with_content('iifname "docker0" oifname != "docker0" counter jump DOCKER_ISOLATION_STAGE_2') }
         it { is_expected.to contain_nftables__rule('DOCKER_ISOLATION_STAGE_1-counter').with_content('counter return') }
         it { is_expected.to contain_nftables__rule('DOCKER_ISOLATION_STAGE_2-drop').with_content('oifname "docker0" counter drop') }
@@ -45,39 +51,44 @@ describe 'nftables::rules::docker_ce' do
         it { is_expected.to contain_nftables__rule('default_fwd-idocker_odocker_accept').with_content('iifname "docker0" oifname "docker0" counter accept') }
 
         it {
-          is_expected.to contain_nftables__rule('POSTROUTING-docker').with(
+          expect(subject).to contain_nftables__rule('POSTROUTING-docker').with(
             content: 'oifname != "docker0" ip saddr 172.17.0.0/16 counter masquerade',
             table: 'ip-nat'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('PREROUTING-docker').with(
+          expect(subject).to contain_nftables__rule('PREROUTING-docker').with(
             content: 'fib daddr type local counter jump DOCKER',
             table: 'ip-nat'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('OUTPUT-jump_docker@ip-nat').with(
+          expect(subject).to contain_nftables__rule('OUTPUT-jump_docker@ip-nat').with(
             rulename: 'OUTPUT-jump_docker',
             content: 'ip daddr != 127.0.0.0/8 fib daddr type local counter jump DOCKER',
             table: 'ip-nat'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('DOCKER-counter').with(
+          expect(subject).to contain_nftables__rule('DOCKER-counter').with(
             content: 'iifname "docker0" counter return',
             table: 'ip-nat'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('INPUT-type@ip-nat').with(
+          expect(subject).to contain_nftables__rule('INPUT-type@ip-nat').with(
             rulename: 'INPUT-type',
             content: 'type nat hook input priority 100',
             table: 'ip-nat'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('INPUT-policy@ip-nat').with(
+          expect(subject).to contain_nftables__rule('INPUT-policy@ip-nat').with(
             rulename: 'INPUT-policy',
             content: 'policy accept',
             table: 'ip-nat'
@@ -140,13 +151,14 @@ describe 'nftables::rules::docker_ce' do
         it { is_expected.to contain_nftables__rule('default_fwd-idocker_odocker_accept').with_content('iifname "ifdo0" oifname "ifdo0" counter accept') }
 
         it {
-          is_expected.to contain_nftables__rule('POSTROUTING-docker').with(
+          expect(subject).to contain_nftables__rule('POSTROUTING-docker').with(
             content: 'oifname != "ifdo0" ip saddr 192.168.4.0/24 counter masquerade',
             table: 'ip-nat'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('DOCKER-counter').with(
+          expect(subject).to contain_nftables__rule('DOCKER-counter').with(
             content: 'iifname "ifdo0" counter return',
             table: 'ip-nat'
           )
diff --git a/spec/classes/rules/icinga2_spec.rb b/spec/classes/rules/icinga2_spec.rb
index 0253cf6..4ddbf98 100644
--- a/spec/classes/rules/icinga2_spec.rb
+++ b/spec/classes/rules/icinga2_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::icinga2' do
diff --git a/spec/classes/rules/icmp_spec.rb b/spec/classes/rules/icmp_spec.rb
index 7ba9885..7c2c107 100644
--- a/spec/classes/rules/icmp_spec.rb
+++ b/spec/classes/rules/icmp_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::icmp' do
@@ -7,14 +9,16 @@ describe 'nftables::rules::icmp' do
 
       context 'default options' do
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-accept_icmpv4').with(
+          expect(subject).to contain_nftables__rule('default_in-accept_icmpv4').with(
             content: 'ip protocol icmp accept',
             order: '10'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-accept_icmpv6').with(
+          expect(subject).to contain_nftables__rule('default_in-accept_icmpv6').with(
             content: 'ip6 nexthdr ipv6-icmp accept',
             order: '10'
           )
@@ -29,20 +33,23 @@ describe 'nftables::rules::icmp' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-accept_icmpv4_echo_request').with(
+          expect(subject).to contain_nftables__rule('default_in-accept_icmpv4_echo_request').with(
             content: 'ip protocol icmp icmp type echo-request limit rate 4/second accept',
             order: '10'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-accept_icmpv4_echo_reply').with(
+          expect(subject).to contain_nftables__rule('default_in-accept_icmpv4_echo_reply').with(
             content: 'ip protocol icmp icmp type echo-reply accept',
             order: '10'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-accept_icmpv6').with(
+          expect(subject).to contain_nftables__rule('default_in-accept_icmpv6').with(
             content: 'ip6 nexthdr ipv6-icmp accept',
             order: '10'
           )
@@ -53,31 +60,35 @@ describe 'nftables::rules::icmp' do
         let(:params) do
           {
             v4_types: ['echo-request limit rate 4/second', 'echo-reply'],
-            v6_types: ['echo-reply', 'nd-router-advert'],
+            v6_types: %w[echo-reply nd-router-advert],
           }
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-accept_icmpv4_echo_request').with(
+          expect(subject).to contain_nftables__rule('default_in-accept_icmpv4_echo_request').with(
             content: 'ip protocol icmp icmp type echo-request limit rate 4/second accept',
             order: '10'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-accept_icmpv4_echo_reply').with(
+          expect(subject).to contain_nftables__rule('default_in-accept_icmpv4_echo_reply').with(
             content: 'ip protocol icmp icmp type echo-reply accept',
             order: '10'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-accept_icmpv6_echo_reply').with(
+          expect(subject).to contain_nftables__rule('default_in-accept_icmpv6_echo_reply').with(
             content: 'ip6 nexthdr ipv6-icmp icmpv6 type echo-reply accept',
             order: '10'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-accept_icmpv6_nd_router_advert').with(
+          expect(subject).to contain_nftables__rule('default_in-accept_icmpv6_nd_router_advert').with(
             content: 'ip6 nexthdr ipv6-icmp icmpv6 type nd-router-advert accept',
             order: '10'
           )
diff --git a/spec/classes/rules/nfs3_spec.rb b/spec/classes/rules/nfs3_spec.rb
index bc53922..7d15585 100644
--- a/spec/classes/rules/nfs3_spec.rb
+++ b/spec/classes/rules/nfs3_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::nfs3' do
diff --git a/spec/classes/rules/nfs_spec.rb b/spec/classes/rules/nfs_spec.rb
index 3733f42..8243958 100644
--- a/spec/classes/rules/nfs_spec.rb
+++ b/spec/classes/rules/nfs_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::nfs' do
diff --git a/spec/classes/rules/node_exporter_spec.rb b/spec/classes/rules/node_exporter_spec.rb
index 7c510a0..40d8d56 100644
--- a/spec/classes/rules/node_exporter_spec.rb
+++ b/spec/classes/rules/node_exporter_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::node_exporter' do
@@ -19,6 +21,7 @@ describe 'nftables::rules::node_exporter' do
 
         it { is_expected.to compile }
         it { is_expected.to contain_nftables__rule('default_in-node_exporter').with_content('tcp dport 100 accept') }
+
         context 'with prometheus_server set' do
           let(:params) do
             super().merge({ prometheus_server: ['127.0.0.1', '::1'] })
diff --git a/spec/classes/rules/out/ceph_client_spec.rb b/spec/classes/rules/out/ceph_client_spec.rb
index f9b5b63..6e440c4 100644
--- a/spec/classes/rules/out/ceph_client_spec.rb
+++ b/spec/classes/rules/out/ceph_client_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::out::ceph_client' do
diff --git a/spec/classes/rules/out/imap_spec.rb b/spec/classes/rules/out/imap_spec.rb
index 7cd33ab..875c220 100644
--- a/spec/classes/rules/out/imap_spec.rb
+++ b/spec/classes/rules/out/imap_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::out::imap' do
diff --git a/spec/classes/rules/out/kerberos_spec.rb b/spec/classes/rules/out/kerberos_spec.rb
index f4af49a..caf3463 100644
--- a/spec/classes/rules/out/kerberos_spec.rb
+++ b/spec/classes/rules/out/kerberos_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::out::kerberos' do
diff --git a/spec/classes/rules/out/nfs3_spec.rb b/spec/classes/rules/out/nfs3_spec.rb
index 3d632ee..23336aa 100644
--- a/spec/classes/rules/out/nfs3_spec.rb
+++ b/spec/classes/rules/out/nfs3_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::out::nfs3' do
diff --git a/spec/classes/rules/out/nfs_spec.rb b/spec/classes/rules/out/nfs_spec.rb
index 2882e96..c78f3e3 100644
--- a/spec/classes/rules/out/nfs_spec.rb
+++ b/spec/classes/rules/out/nfs_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::out::nfs' do
diff --git a/spec/classes/rules/out/openafs_client_spec.rb b/spec/classes/rules/out/openafs_client_spec.rb
index f8c8ac6..a90ab7b 100644
--- a/spec/classes/rules/out/openafs_client_spec.rb
+++ b/spec/classes/rules/out/openafs_client_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::out::openafs_client' do
diff --git a/spec/classes/rules/out/pop3_spec.rb b/spec/classes/rules/out/pop3_spec.rb
index f26b363..d3d5778 100644
--- a/spec/classes/rules/out/pop3_spec.rb
+++ b/spec/classes/rules/out/pop3_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::out::pop3' do
diff --git a/spec/classes/rules/out/puppet_spec.rb b/spec/classes/rules/out/puppet_spec.rb
index 11f5f88..922db5c 100644
--- a/spec/classes/rules/out/puppet_spec.rb
+++ b/spec/classes/rules/out/puppet_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::out::puppet' do
@@ -12,6 +14,7 @@ describe 'nftables::rules::out::puppet' do
         it { is_expected.to compile }
         it { is_expected.to contain_nftables__rule('default_out-puppet-0').with_content('ip daddr 1.2.3.4 tcp dport 8140 accept') }
       end
+
       context 'with different port' do
         let(:params) do
           super().merge({ puppetserver_port: 8141 })
@@ -20,6 +23,7 @@ describe 'nftables::rules::out::puppet' do
         it { is_expected.to compile }
         it { is_expected.to contain_nftables__rule('default_out-puppet-0').with_content('ip daddr 1.2.3.4 tcp dport 8141 accept') }
       end
+
       context 'with ipv6 address' do
         let(:params) do
           { puppetserver: 'fe80::1' }
@@ -28,6 +32,7 @@ describe 'nftables::rules::out::puppet' do
         it { is_expected.to compile }
         it { is_expected.to contain_nftables__rule('default_out-puppet-0').with_content('ip6 daddr fe80::1 tcp dport 8140 accept') }
       end
+
       context 'with ipv6 & ipv4 address' do
         let(:params) do
           { puppetserver: ['fe80::1', '1.2.3.4'] }
diff --git a/spec/classes/rules/out/smtp_client_spec.rb b/spec/classes/rules/out/smtp_client_spec.rb
index 4e4c7db..1fb8898 100644
--- a/spec/classes/rules/out/smtp_client_spec.rb
+++ b/spec/classes/rules/out/smtp_client_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::out::smtp_client' do
diff --git a/spec/classes/rules/out/smtp_spec.rb b/spec/classes/rules/out/smtp_spec.rb
index dc4b2f7..900d781 100644
--- a/spec/classes/rules/out/smtp_spec.rb
+++ b/spec/classes/rules/out/smtp_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::out::smtp' do
diff --git a/spec/classes/rules/qemu_spec.rb b/spec/classes/rules/qemu_spec.rb
index 4bccd30..4738cb0 100644
--- a/spec/classes/rules/qemu_spec.rb
+++ b/spec/classes/rules/qemu_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::qemu' do
@@ -8,58 +10,70 @@ describe 'nftables::rules::qemu' do
 
       context 'default options' do
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-qemu_udp_dns').
+          expect(subject).to contain_nftables__rule('default_in-qemu_udp_dns').
             with_content('iifname "virbr0" udp dport 53 accept')
         }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-qemu_tcp_dns').
+          expect(subject).to contain_nftables__rule('default_in-qemu_tcp_dns').
             with_content('iifname "virbr0" tcp dport 53 accept')
         }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-qemu_dhcpv4').
+          expect(subject).to contain_nftables__rule('default_in-qemu_dhcpv4').
             with_content('iifname "virbr0" meta l4proto udp udp dport 67 accept')
         }
+
         it {
-          is_expected.to contain_nftables__rule('default_fwd-qemu_oip_v4').
+          expect(subject).to contain_nftables__rule('default_fwd-qemu_oip_v4').
             with_content('oifname "virbr0" ip daddr 192.168.122.0/24 ct state related,established accept')
         }
+
         it {
-          is_expected.to contain_nftables__rule('default_fwd-qemu_iip_v4').
+          expect(subject).to contain_nftables__rule('default_fwd-qemu_iip_v4').
             with_content('iifname "virbr0" ip saddr 192.168.122.0/24 accept')
         }
+
         it { is_expected.not_to contain_nftables__rule('default_fwd-qemu_oip_v6') }
         it { is_expected.not_to contain_nftables__rule('default_fwd-qemu_iip_v6') }
+
         it {
-          is_expected.to contain_nftables__rule('default_fwd-qemu_io_internal').
+          expect(subject).to contain_nftables__rule('default_fwd-qemu_io_internal').
             with_content('iifname "virbr0" oifname "virbr0" accept')
         }
+
         it {
-          is_expected.to contain_nftables__rule('POSTROUTING-qemu_ignore_multicast').with(
+          expect(subject).to contain_nftables__rule('POSTROUTING-qemu_ignore_multicast').with(
             content: 'ip saddr 192.168.122.0/24 ip daddr 224.0.0.0/24 return',
             table: 'ip-nat'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('POSTROUTING-qemu_ignore_broadcast').with(
+          expect(subject).to contain_nftables__rule('POSTROUTING-qemu_ignore_broadcast').with(
             content: 'ip saddr 192.168.122.0/24 ip daddr 255.255.255.255 return',
             table: 'ip-nat'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('POSTROUTING-qemu_masq_tcp').with(
+          expect(subject).to contain_nftables__rule('POSTROUTING-qemu_masq_tcp').with(
             content: 'meta l4proto tcp ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 masquerade to :1024-65535',
             table: 'ip-nat'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('POSTROUTING-qemu_masq_udp').with(
+          expect(subject).to contain_nftables__rule('POSTROUTING-qemu_masq_udp').with(
             content: 'meta l4proto udp ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 masquerade to :1024-65535',
             table: 'ip-nat'
           )
         }
+
         it {
-          is_expected.to contain_nftables__rule('POSTROUTING-qemu_masq_ip').with(
+          expect(subject).to contain_nftables__rule('POSTROUTING-qemu_masq_ip').with(
             content: 'ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 masquerade',
             table: 'ip-nat'
           )
@@ -99,20 +113,24 @@ describe 'nftables::rules::qemu' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_fwd-qemu_oip_v4').
+          expect(subject).to contain_nftables__rule('default_fwd-qemu_oip_v4').
             with_content('oifname "virbr0" ip daddr 192.168.122.0/24 ct state related,established accept')
         }
+
         it {
-          is_expected.to contain_nftables__rule('default_fwd-qemu_iip_v4').
+          expect(subject).to contain_nftables__rule('default_fwd-qemu_iip_v4').
             with_content('iifname "virbr0" ip saddr 192.168.122.0/24 accept')
         }
+
         it {
-          is_expected.to contain_nftables__rule('default_fwd-qemu_oip_v6').
+          expect(subject).to contain_nftables__rule('default_fwd-qemu_oip_v6').
             with_content('oifname "virbr0" ip6 daddr 20ac:cafe:1:1::/64 ct state related,established accept')
         }
+
         it {
-          is_expected.to contain_nftables__rule('default_fwd-qemu_iip_v6').
+          expect(subject).to contain_nftables__rule('default_fwd-qemu_iip_v6').
             with_content('iifname "virbr0" ip6 saddr 20ac:cafe:1:1::/64 accept')
         }
       end
@@ -125,8 +143,9 @@ describe 'nftables::rules::qemu' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_fwd-qemu_iip_v4').
+          expect(subject).to contain_nftables__rule('default_fwd-qemu_iip_v4').
             with_content('iifname "vfoo0" ip saddr 192.168.122.0/24 accept')
         }
       end
@@ -139,8 +158,9 @@ describe 'nftables::rules::qemu' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_fwd-qemu_iip_v4').
+          expect(subject).to contain_nftables__rule('default_fwd-qemu_iip_v4').
             with_content('iifname "virbr0" ip saddr 172.16.0.0/12 accept')
         }
       end
diff --git a/spec/classes/rules/samba_spec.rb b/spec/classes/rules/samba_spec.rb
index 7e09203..17ea711 100644
--- a/spec/classes/rules/samba_spec.rb
+++ b/spec/classes/rules/samba_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::samba' do
diff --git a/spec/classes/rules/ssh_spec.rb b/spec/classes/rules/ssh_spec.rb
index 06a23c4..a489210 100644
--- a/spec/classes/rules/ssh_spec.rb
+++ b/spec/classes/rules/ssh_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::ssh' do
diff --git a/spec/classes/rules/tor_spec.rb b/spec/classes/rules/tor_spec.rb
index 44081e5..7cccd95 100644
--- a/spec/classes/rules/tor_spec.rb
+++ b/spec/classes/rules/tor_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::tor' do
diff --git a/spec/classes/rules/wireguard_spec.rb b/spec/classes/rules/wireguard_spec.rb
index e9c33d4..5ba9963 100644
--- a/spec/classes/rules/wireguard_spec.rb
+++ b/spec/classes/rules/wireguard_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::wireguard' do
diff --git a/spec/classes/rules_out_dns_spec.rb b/spec/classes/rules_out_dns_spec.rb
index bcf1be2..137620f 100644
--- a/spec/classes/rules_out_dns_spec.rb
+++ b/spec/classes/rules_out_dns_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables' do
@@ -15,17 +17,18 @@ describe 'nftables' do
         end
 
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnsudp').with(
-            target:  'nftables-inet-filter-chain-default_out',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnsudp').with(
+            target: 'nftables-inet-filter-chain-default_out',
             content: %r{^  udp dport 53 accept$},
-            order:   '50-nftables-inet-filter-chain-default_out-rule-dnsudp-b'
+            order: '50-nftables-inet-filter-chain-default_out-rule-dnsudp-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnstcp').with(
-            target:  'nftables-inet-filter-chain-default_out',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnstcp').with(
+            target: 'nftables-inet-filter-chain-default_out',
             content: %r{^  tcp dport 53 accept$},
-            order:   '50-nftables-inet-filter-chain-default_out-rule-dnstcp-b'
+            order: '50-nftables-inet-filter-chain-default_out-rule-dnstcp-b'
           )
         }
       end
@@ -42,32 +45,34 @@ describe 'nftables' do
         it { is_expected.to compile }
 
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnsudp-0').with(
-            target:  'nftables-inet-filter-chain-default_out',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnsudp-0').with(
+            target: 'nftables-inet-filter-chain-default_out',
             content: %r{^  ip daddr 192.0.2.1 udp dport 53 accept$},
-            order:   '50-nftables-inet-filter-chain-default_out-rule-dnsudp-0-b'
+            order: '50-nftables-inet-filter-chain-default_out-rule-dnsudp-0-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnstcp-0').with(
-            target:  'nftables-inet-filter-chain-default_out',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnstcp-0').with(
+            target: 'nftables-inet-filter-chain-default_out',
             content: %r{^  ip daddr 192.0.2.1 tcp dport 53 accept$},
-            order:   '50-nftables-inet-filter-chain-default_out-rule-dnstcp-0-b'
+            order: '50-nftables-inet-filter-chain-default_out-rule-dnstcp-0-b'
           )
         }
 
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnsudp-1').with(
-            target:  'nftables-inet-filter-chain-default_out',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnsudp-1').with(
+            target: 'nftables-inet-filter-chain-default_out',
             content: %r{^  ip6 daddr 2001:db8::1 udp dport 53 accept$},
-            order:   '50-nftables-inet-filter-chain-default_out-rule-dnsudp-1-b'
+            order: '50-nftables-inet-filter-chain-default_out-rule-dnsudp-1-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnstcp-1').with(
-            target:  'nftables-inet-filter-chain-default_out',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnstcp-1').with(
+            target: 'nftables-inet-filter-chain-default_out',
             content: %r{^  ip6 daddr 2001:db8::1 tcp dport 53 accept$},
-            order:   '50-nftables-inet-filter-chain-default_out-rule-dnstcp-1-b'
+            order: '50-nftables-inet-filter-chain-default_out-rule-dnstcp-1-b'
           )
         }
       end
diff --git a/spec/classes/services/dhcpv6_client_spec.rb b/spec/classes/services/dhcpv6_client_spec.rb
index 96ccf8f..1d8a2aa 100644
--- a/spec/classes/services/dhcpv6_client_spec.rb
+++ b/spec/classes/services/dhcpv6_client_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::services::dhcpv6_client' do
diff --git a/spec/classes/services/openafs_client_spec.rb b/spec/classes/services/openafs_client_spec.rb
index f2d944f..13a0d71 100644
--- a/spec/classes/services/openafs_client_spec.rb
+++ b/spec/classes/services/openafs_client_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::services::openafs_client' do
diff --git a/spec/classes/snat4_spec.rb b/spec/classes/snat4_spec.rb
index 5826dfa..22896f2 100644
--- a/spec/classes/snat4_spec.rb
+++ b/spec/classes/snat4_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables' do
@@ -36,68 +38,76 @@ describe 'nftables' do
         it { is_expected.to compile }
 
         it {
-          is_expected.to contain_concat('nftables-ip-nat-chain-POSTROUTING').with(
-            path:           '/etc/nftables/puppet-preflight/ip-nat-chain-POSTROUTING.nft',
-            owner:          'root',
-            group:          'root',
-            mode:           '0640',
+          expect(subject).to contain_concat('nftables-ip-nat-chain-POSTROUTING').with(
+            path: '/etc/nftables/puppet-preflight/ip-nat-chain-POSTROUTING.nft',
+            owner: 'root',
+            group: 'root',
+            mode: '0640',
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-header').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-header').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^chain POSTROUTING \{$},
-            order:   '00'
+            order: '00'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  type nat hook postrouting priority 100$},
-            order:   '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b'
+            order: '01-nftables-ip-nat-chain-POSTROUTING-rule-type-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  policy accept$},
-            order:   '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b'
+            order: '02-nftables-ip-nat-chain-POSTROUTING-rule-policy-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-static').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-static').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  oifname eth0 snat 198\.51\.100\.1$},
-            order:   '60-nftables-ip-nat-chain-POSTROUTING-rule-static-b'
+            order: '60-nftables-ip-nat-chain-POSTROUTING-rule-static-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-1_1').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-1_1').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  oifname eth0 ip saddr 192\.0\.2\.2 snat 198\.51\.100\.3$},
-            order:   '61-nftables-ip-nat-chain-POSTROUTING-rule-1_1-b'
+            order: '61-nftables-ip-nat-chain-POSTROUTING-rule-1_1-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-1_1_smtp').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-1_1_smtp').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  ip saddr 192\.0\.2\.2 tcp dport 25 snat 198\.51\.100\.2$},
-            order:   '70-nftables-ip-nat-chain-POSTROUTING-rule-1_1_smtp-b'
+            order: '70-nftables-ip-nat-chain-POSTROUTING-rule-1_1_smtp-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-1_1_wireguard').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-1_1_wireguard').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  ip saddr 192\.0\.2\.2 udp dport 51820 snat 198\.51\.100\.2$},
-            order:   '70-nftables-ip-nat-chain-POSTROUTING-rule-1_1_wireguard-b'
+            order: '70-nftables-ip-nat-chain-POSTROUTING-rule-1_1_wireguard-b'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-footer').with(
-            target:  'nftables-ip-nat-chain-POSTROUTING',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-footer').with(
+            target: 'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^\}$},
-            order:   '99'
+            order: '99'
           )
         }
       end
diff --git a/spec/defines/chain_spec.rb b/spec/defines/chain_spec.rb
index 8c531ec..666c9d5 100644
--- a/spec/defines/chain_spec.rb
+++ b/spec/defines/chain_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::chain' do
@@ -17,7 +19,7 @@ describe 'nftables::chain' do
       it { is_expected.to contain_file('/etc/nftables/puppet/inet-filter-chain-MYCHAIN.nft').that_comes_before('Service[nftables]') }
 
       it {
-        is_expected.to contain_concat('nftables-inet-filter-chain-MYCHAIN').with(
+        expect(subject).to contain_concat('nftables-inet-filter-chain-MYCHAIN').with(
           path: '/etc/nftables/puppet-preflight/inet-filter-chain-MYCHAIN.nft',
           owner: 'root',
           group: 'root',
@@ -25,8 +27,9 @@ describe 'nftables::chain' do
           ensure_newline: true
         )
       }
+
       it {
-        is_expected.to contain_file('/etc/nftables/puppet/inet-filter-chain-MYCHAIN.nft').with(
+        expect(subject).to contain_file('/etc/nftables/puppet/inet-filter-chain-MYCHAIN.nft').with(
           ensure: 'file',
           source: '/etc/nftables/puppet-preflight/inet-filter-chain-MYCHAIN.nft',
           mode: '0640',
@@ -34,15 +37,17 @@ describe 'nftables::chain' do
           group: 'root'
         )
       }
+
       it {
-        is_expected.to contain_concat__fragment('nftables-inet-filter-chain-MYCHAIN-header').with(
+        expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-MYCHAIN-header').with(
           order: '00',
           content: "# Start of fragment order:00 MYCHAIN header\nchain MYCHAIN {",
           target: 'nftables-inet-filter-chain-MYCHAIN'
         )
       }
+
       it {
-        is_expected.to contain_concat__fragment('nftables-inet-filter-chain-MYCHAIN-footer').with(
+        expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-MYCHAIN-footer').with(
           order: '99',
           content: "# Start of fragment order:99 MYCHAIN footer\n}",
           target: 'nftables-inet-filter-chain-MYCHAIN'
@@ -57,7 +62,7 @@ describe 'nftables::chain' do
         end
 
         it {
-          is_expected.to contain_concat('nftables-ip6-foo-chain-MYCHAIN').with(
+          expect(subject).to contain_concat('nftables-ip6-foo-chain-MYCHAIN').with(
             path: '/etc/nftables/puppet-preflight/ip6-foo-chain-MYCHAIN.nft',
             owner: 'root',
             group: 'root',
@@ -65,8 +70,9 @@ describe 'nftables::chain' do
             ensure_newline: true
           )
         }
+
         it {
-          is_expected.to contain_file('/etc/nftables/puppet/ip6-foo-chain-MYCHAIN.nft').with(
+          expect(subject).to contain_file('/etc/nftables/puppet/ip6-foo-chain-MYCHAIN.nft').with(
             ensure: 'file',
             source: '/etc/nftables/puppet-preflight/ip6-foo-chain-MYCHAIN.nft',
             mode: '0640',
@@ -74,21 +80,24 @@ describe 'nftables::chain' do
             group: 'root'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip6-foo-chain-MYCHAIN-header').with(
+          expect(subject).to contain_concat__fragment('nftables-ip6-foo-chain-MYCHAIN-header').with(
             order: '00',
             content: "# Start of fragment order:00 MYCHAIN header\nchain MYCHAIN {",
             target: 'nftables-ip6-foo-chain-MYCHAIN'
           )
         }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip6-foo-chain-MYCHAIN-footer').with(
+          expect(subject).to contain_concat__fragment('nftables-ip6-foo-chain-MYCHAIN-footer').with(
             order: '99',
             content: "# Start of fragment order:99 MYCHAIN footer\n}",
             target: 'nftables-ip6-foo-chain-MYCHAIN'
           )
         }
       end
+
       context 'with inject set to 22-foobar' do
         let(:params) do
           {
@@ -97,19 +106,21 @@ describe 'nftables::chain' do
         end
 
         it { is_expected.to contain_nftables__rule('foobar-jump_MYCHAIN') }
+
         it {
-          is_expected.to contain_nftables__rule('foobar-jump_MYCHAIN').with(
+          expect(subject).to contain_nftables__rule('foobar-jump_MYCHAIN').with(
             order: '22',
             content: 'jump MYCHAIN'
           )
         }
+
         context 'with inject_oif set to alpha and inject_oif set to beta' do
           let(:params) do
             super().merge(inject_iif: 'alpha', inject_oif: 'beta')
           end
 
           it {
-            is_expected.to contain_nftables__rule('foobar-jump_MYCHAIN').with(
+            expect(subject).to contain_nftables__rule('foobar-jump_MYCHAIN').with(
               order: '22',
               content: 'iifname alpha oifname beta jump MYCHAIN'
             )
diff --git a/spec/defines/config_spec.rb b/spec/defines/config_spec.rb
index f9238c1..8e99525 100644
--- a/spec/defines/config_spec.rb
+++ b/spec/defines/config_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::config' do
@@ -13,31 +15,37 @@ describe 'nftables::config' do
       context 'with source and content both unset' do
         it { is_expected.to compile }
         it { is_expected.to contain_concat('nftables-FOO-BAR') }
+
         it {
-          is_expected.to contain_concat('nftables-FOO-BAR').with(
+          expect(subject).to contain_concat('nftables-FOO-BAR').with(
             path: '/etc/nftables/puppet-preflight/custom-FOO-BAR.nft',
             ensure_newline: true,
             mode: '0640'
           )
         }
+
         it { is_expected.to contain_file('/etc/nftables/puppet/custom-FOO-BAR.nft') }
+
         it {
-          is_expected.to contain_file('/etc/nftables/puppet/custom-FOO-BAR.nft').with(
+          expect(subject).to contain_file('/etc/nftables/puppet/custom-FOO-BAR.nft').with(
             ensure: 'file',
             source: '/etc/nftables/puppet-preflight/custom-FOO-BAR.nft',
             mode: '0640'
           )
         }
+
         it { is_expected.to contain_concat_fragment('nftables-FOO-BAR-header') }
+
         it {
-          is_expected.to contain_concat_fragment('nftables-FOO-BAR-header').with(
+          expect(subject).to contain_concat_fragment('nftables-FOO-BAR-header').with(
             target: 'nftables-FOO-BAR',
             order: '00',
             content: 'table FOO BAR {'
           )
         }
+
         it {
-          is_expected.to contain_concat_fragment('nftables-FOO-BAR-body').with(
+          expect(subject).to contain_concat_fragment('nftables-FOO-BAR-body').with(
             target: 'nftables-FOO-BAR',
             order: '98',
             content: '  include "FOO-BAR-chain-*.nft"'
@@ -60,9 +68,10 @@ describe 'nftables::config' do
         end
 
         it {
-          is_expected.not_to compile
+          expect(subject).not_to compile
         }
       end
+
       context 'with content set' do
         let(:params) do
           {
@@ -72,37 +81,44 @@ describe 'nftables::config' do
 
         it { is_expected.to compile }
         it { is_expected.to contain_concat('nftables-FOO-BAR') }
+
         it {
-          is_expected.to contain_concat('nftables-FOO-BAR').with(
+          expect(subject).to contain_concat('nftables-FOO-BAR').with(
             path: '/etc/nftables/puppet-preflight/custom-FOO-BAR.nft',
             ensure_newline: true,
             mode: '0640'
           )
         }
+
         it { is_expected.to contain_file('/etc/nftables/puppet/custom-FOO-BAR.nft') }
+
         it {
-          is_expected.to contain_file('/etc/nftables/puppet/custom-FOO-BAR.nft').with(
+          expect(subject).to contain_file('/etc/nftables/puppet/custom-FOO-BAR.nft').with(
             ensure: 'file',
             source: '/etc/nftables/puppet-preflight/custom-FOO-BAR.nft',
             mode: '0640'
           )
         }
+
         it { is_expected.to contain_concat_fragment('nftables-FOO-BAR-header') }
+
         it {
-          is_expected.to contain_concat_fragment('nftables-FOO-BAR-header').with(
+          expect(subject).to contain_concat_fragment('nftables-FOO-BAR-header').with(
             target: 'nftables-FOO-BAR',
             order: '00',
             content: 'table FOO BAR {'
           )
         }
+
         it {
-          is_expected.to contain_concat_fragment('nftables-FOO-BAR-body').with(
+          expect(subject).to contain_concat_fragment('nftables-FOO-BAR-body').with(
             target: 'nftables-FOO-BAR',
             order: '98',
             content: 'strange content'
           )
         }
       end
+
       context 'with source set' do
         let(:params) do
           {
@@ -111,7 +127,7 @@ describe 'nftables::config' do
         end
 
         it {
-          is_expected.to contain_concat_fragment('nftables-FOO-BAR-body').with(
+          expect(subject).to contain_concat_fragment('nftables-FOO-BAR-body').with(
             target: 'nftables-FOO-BAR',
             order: '98',
             source: 'puppet:///modules/foo'
diff --git a/spec/defines/rule_spec.rb b/spec/defines/rule_spec.rb
index 5e44c4c..02ea058 100644
--- a/spec/defines/rule_spec.rb
+++ b/spec/defines/rule_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rule' do
@@ -15,6 +17,7 @@ describe 'nftables::rule' do
         context 'with source and content both unset' do
           it { is_expected.not_to compile }
         end
+
         context 'with source and content both set' do
           let(:params) do
             {
@@ -25,7 +28,7 @@ describe 'nftables::rule' do
 
           it {
             pending('Setting source and content should be made to fail')
-            is_expected.not_to compile
+            expect(subject).not_to compile
           }
         end
 
@@ -36,20 +39,23 @@ describe 'nftables::rule' do
 
           it { is_expected.to compile.with_all_deps }
           it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE') }
+
           it {
-            is_expected.to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE_header').with(
+            expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE_header').with(
               order: '50-nftables-inet-filter-chain-CHAIN_NAME-rule-RULE-a',
               target: 'nftables-inet-filter-chain-CHAIN_NAME',
               content: %r{^#.*$}
             )
           }
+
           it {
-            is_expected.to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE').with(
+            expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE').with(
               order: '50-nftables-inet-filter-chain-CHAIN_NAME-rule-RULE-b',
               target: 'nftables-inet-filter-chain-CHAIN_NAME',
               content: '  port 22 allow'
             )
           }
+
           context 'with optional parameters set' do
             let(:params) do
               super().merge(order: '85',
@@ -57,15 +63,17 @@ describe 'nftables::rule' do
             end
 
             it {
-              is_expected.to contain_concat__fragment('nftables-TABLE-chain-CHAIN_NAME-rule-RULE_header').with(
+              expect(subject).to contain_concat__fragment('nftables-TABLE-chain-CHAIN_NAME-rule-RULE_header').with(
                 order: '85-nftables-TABLE-chain-CHAIN_NAME-rule-RULE-a',
                 target: 'nftables-TABLE-chain-CHAIN_NAME',
                 content: %r{^#.*$}
               )
             }
+
             it { is_expected.to contain_concat__fragment('nftables-TABLE-chain-CHAIN_NAME-rule-RULE') }
+
             it {
-              is_expected.to contain_concat__fragment('nftables-TABLE-chain-CHAIN_NAME-rule-RULE').with(
+              expect(subject).to contain_concat__fragment('nftables-TABLE-chain-CHAIN_NAME-rule-RULE').with(
                 order: '85-nftables-TABLE-chain-CHAIN_NAME-rule-RULE-b',
                 target: 'nftables-TABLE-chain-CHAIN_NAME',
                 content: '  port 22 allow'
@@ -83,20 +91,23 @@ describe 'nftables::rule' do
 
           it { is_expected.to compile.with_all_deps }
           it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE') }
+
           it {
-            is_expected.to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE_header').with(
+            expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE_header').with(
               order: '50-nftables-inet-filter-chain-CHAIN_NAME-rule-RULE-a',
               target: 'nftables-inet-filter-chain-CHAIN_NAME',
               content: %r{^#.*$}
             )
           }
+
           it {
-            is_expected.to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE').with(
+            expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE').with(
               order: '50-nftables-inet-filter-chain-CHAIN_NAME-rule-RULE-b',
               target: 'nftables-inet-filter-chain-CHAIN_NAME',
               source: 'puppet:///modules/foo/bar'
             )
           }
+
           context 'with optional parameters set' do
             let(:params) do
               super().merge(order: '85',
@@ -104,15 +115,17 @@ describe 'nftables::rule' do
             end
 
             it {
-              is_expected.to contain_concat__fragment('nftables-TABLE-chain-CHAIN_NAME-rule-RULE_header').with(
+              expect(subject).to contain_concat__fragment('nftables-TABLE-chain-CHAIN_NAME-rule-RULE_header').with(
                 order: '85-nftables-TABLE-chain-CHAIN_NAME-rule-RULE-a',
                 target: 'nftables-TABLE-chain-CHAIN_NAME',
                 content: %r{^#.*$}
               )
             }
+
             it { is_expected.to contain_concat__fragment('nftables-TABLE-chain-CHAIN_NAME-rule-RULE') }
+
             it {
-              is_expected.to contain_concat__fragment('nftables-TABLE-chain-CHAIN_NAME-rule-RULE').with(
+              expect(subject).to contain_concat__fragment('nftables-TABLE-chain-CHAIN_NAME-rule-RULE').with(
                 order: '85-nftables-TABLE-chain-CHAIN_NAME-rule-RULE-b',
                 target: 'nftables-TABLE-chain-CHAIN_NAME',
                 source: 'puppet:///modules/foo/bar'
@@ -134,15 +147,17 @@ describe 'nftables::rule' do
 
           it { is_expected.to compile.with_all_deps }
           it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE-22') }
+
           it {
-            is_expected.to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE-22_header').with(
+            expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE-22_header').with(
               order: '50-nftables-inet-filter-chain-CHAIN_NAME-rule-RULE-22-a',
               target: 'nftables-inet-filter-chain-CHAIN_NAME',
               content: %r{^#.*$}
             )
           }
+
           it {
-            is_expected.to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE-22').with(
+            expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-CHAIN_NAME-rule-RULE-22').with(
               order: '50-nftables-inet-filter-chain-CHAIN_NAME-rule-RULE-22-b',
               target: 'nftables-inet-filter-chain-CHAIN_NAME',
               content: '  port 22 allow'
diff --git a/spec/defines/rules/dnat4_spec.rb b/spec/defines/rules/dnat4_spec.rb
index a514398..3fcfeec 100644
--- a/spec/defines/rules/dnat4_spec.rb
+++ b/spec/defines/rules/dnat4_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::dnat4' do
diff --git a/spec/defines/rules/masquerade_spec.rb b/spec/defines/rules/masquerade_spec.rb
index c4106f1..5d1fb51 100644
--- a/spec/defines/rules/masquerade_spec.rb
+++ b/spec/defines/rules/masquerade_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::masquerade' do
@@ -14,6 +16,7 @@ describe 'nftables::rules::masquerade' do
         it { is_expected.to compile.with_all_deps }
         it { is_expected.to contain_nftables__rule('POSTROUTING-foobar').with_content('masquerade') }
       end
+
       context 'with dport specified' do
         let(:params) do
           {
diff --git a/spec/defines/rules/snat4_spec.rb b/spec/defines/rules/snat4_spec.rb
index 1e0ebb4..26ce607 100644
--- a/spec/defines/rules/snat4_spec.rb
+++ b/spec/defines/rules/snat4_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::rules::snat4' do
@@ -19,6 +21,7 @@ describe 'nftables::rules::snat4' do
 
         it { is_expected.to compile.with_all_deps }
         it { is_expected.to contain_nftables__rule('POSTROUTING-foobar').with_content('snat sausage') }
+
         context 'with dport specified' do
           let(:params) do
             super().merge(dport: 1234)
diff --git a/spec/defines/set_spec.rb b/spec/defines/set_spec.rb
index 40b6964..afd599a 100644
--- a/spec/defines/set_spec.rb
+++ b/spec/defines/set_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::set' do
@@ -17,11 +19,12 @@ describe 'nftables::set' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-set-my_set').with(
-            target:  'nftables-inet-filter',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-set-my_set').with(
+            target: 'nftables-inet-filter',
             content: %r{^  set my_set \{\n    type ipv4_addr\n  \}$}m,
-            order:   '10'
+            order: '10'
           )
         }
       end
@@ -68,11 +71,12 @@ describe 'nftables::set' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-set-my_set').with(
-            target:  'nftables-inet-filter',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-set-my_set').with(
+            target: 'nftables-inet-filter',
             content: %r{^  set my_set \{\n    type ipv6_addr\n    elements = \{ 2001:1458::/32, 2001:1458:1::/48 \}\n  \}$}m,
-            order:   '10'
+            order: '10'
           )
         }
       end
@@ -88,11 +92,12 @@ describe 'nftables::set' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-set-my_set').with(
-            target:  'nftables-inet-filter',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-set-my_set').with(
+            target: 'nftables-inet-filter',
             content: %r{^  set my_set \{\n    type ipv4_addr\n    flags interval, timeout\n    elements = \{ 192.168.0.1/24 \}\n    auto-merge\n  \}$}m,
-            order:   '10'
+            order: '10'
           )
         }
       end
@@ -107,11 +112,12 @@ describe 'nftables::set' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-set-my_set').with(
-            target:  'nftables-inet-filter',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-set-my_set').with(
+            target: 'nftables-inet-filter',
             content: %r{^  set my_set \{\n    type ether_addr\n    elements = \{ aa:bb:cc:dd:ee:ff \}\n    policy memory\n  \}$}m,
-            order:   '10'
+            order: '10'
           )
         }
       end
@@ -124,11 +130,12 @@ describe 'nftables::set' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-set-my_set').with(
-            target:  'nftables-inet-filter',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-set-my_set').with(
+            target: 'nftables-inet-filter',
             content: '  set my_set { }',
-            order:   '10'
+            order: '10'
           )
         }
       end
@@ -146,11 +153,12 @@ describe 'nftables::set' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-set-my-set').with(
-            target:  'nftables-inet-filter',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-set-my-set').with(
+            target: 'nftables-inet-filter',
             content: %r{^  set my-set \{\n    type ether_addr\n  \}$}m,
-            order:   '10'
+            order: '10'
           )
         }
       end
@@ -165,11 +173,12 @@ describe 'nftables::set' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-ip-nat-set-my_set').with(
-            target:  'nftables-ip-nat',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-set-my_set').with(
+            target: 'nftables-ip-nat',
             content: %r{^  set my_set \{\n    type ipv6_addr\n    elements = \{ 2001:1458::1, 2001:1458:1::2 \}\n  \}$}m,
-            order:   '10'
+            order: '10'
           )
         }
       end
@@ -191,21 +200,22 @@ describe 'nftables::set' do
           {
             type: 'ipv6_addr',
             elements: ['2001:1458::1', '2001:1458:1::2'],
-            table: ['inet-filter', 'ip-nat']
+            table: %w[inet-filter ip-nat]
           }
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_concat__fragment('nftables-inet-filter-set-my_set').with(
-            target:  'nftables-inet-filter',
+          expect(subject).to contain_concat__fragment('nftables-inet-filter-set-my_set').with(
+            target: 'nftables-inet-filter',
             content: %r{^  set my_set \{\n    type ipv6_addr\n    elements = \{ 2001:1458::1, 2001:1458:1::2 \}\n  \}$}m,
-            order:   '10'
+            order: '10'
           )
-          is_expected.to contain_concat__fragment('nftables-ip-nat-set-my_set').with(
-            target:  'nftables-ip-nat',
+          expect(subject).to contain_concat__fragment('nftables-ip-nat-set-my_set').with(
+            target: 'nftables-ip-nat',
             content: %r{^  set my_set \{\n    type ipv6_addr\n    elements = \{ 2001:1458::1, 2001:1458:1::2 \}\n  \}$}m,
-            order:   '10'
+            order: '10'
           )
         }
       end
diff --git a/spec/defines/simplerule_spec.rb b/spec/defines/simplerule_spec.rb
index ddfce72..15fec45 100644
--- a/spec/defines/simplerule_spec.rb
+++ b/spec/defines/simplerule_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables::simplerule' do
@@ -11,8 +13,9 @@ describe 'nftables::simplerule' do
 
       describe 'minimum instantiation' do
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'accept',
             order: '50'
           )
@@ -56,8 +59,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_out-my_big_rule').with(
+          expect(subject).to contain_nftables__rule('default_out-my_big_rule').with(
             content: 'udp sport {444} udp dport {333} ip6 saddr 2001:145c::/32 ip6 daddr 2001:1458::/32 counter accept comment "this is my rule"',
             order: '50'
           )
@@ -74,8 +78,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'tcp sport {1-2} tcp dport {333-334} accept'
           )
         }
@@ -91,8 +96,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'tcp sport {433, 435} tcp dport {333, 335} accept'
           )
         }
@@ -107,8 +113,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'tcp sport {555} accept'
           )
         }
@@ -123,8 +130,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'ip version 4 tcp dport {333} accept'
           )
         }
@@ -139,8 +147,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'ip6 version 6 udp dport {33} accept'
           )
         }
@@ -155,8 +164,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'ip6 version 6 tcp dport {35} accept'
           )
         }
@@ -172,8 +182,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'tcp dport {33} ip daddr 192.168.0.1/24 accept'
           )
         }
@@ -187,8 +198,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'ip6 daddr 2001:1458::1 accept'
           )
         }
@@ -202,8 +214,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'ip6 saddr 2001:1458:0000:0000:0000:0000:0000:0003 accept'
           )
         }
@@ -217,8 +230,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'ip saddr 172.16.1.5 accept'
           )
         }
@@ -232,8 +246,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'ip6 daddr @my6_set accept'
           )
         }
@@ -248,8 +263,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'ip daddr @my4_set accept'
           )
         }
@@ -264,8 +280,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'ip6 saddr @my6_set accept'
           )
         }
@@ -279,8 +296,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'counter accept'
           )
         }
@@ -297,8 +315,9 @@ describe 'nftables::simplerule' do
         end
 
         it { is_expected.to compile }
+
         it {
-          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
+          expect(subject).to contain_nftables__rule('default_in-my_default_rule_name').with(
             content: 'tcp sport {80} counter continue'
           )
         }
diff --git a/spec/type_aliases/nftables_addr_spec.rb b/spec/type_aliases/nftables_addr_spec.rb
index 3e1d610..d99ae2d 100644
--- a/spec/type_aliases/nftables_addr_spec.rb
+++ b/spec/type_aliases/nftables_addr_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'Nftables::Addr' do
diff --git a/spec/type_aliases/nftables_port_spec.rb b/spec/type_aliases/nftables_port_spec.rb
index ccd649a..399275f 100644
--- a/spec/type_aliases/nftables_port_spec.rb
+++ b/spec/type_aliases/nftables_port_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'Nftables::Port' do
diff --git a/spec/type_aliases/nftables_rulename_spec.rb b/spec/type_aliases/nftables_rulename_spec.rb
index 4406573..1d6db0e 100644
--- a/spec/type_aliases/nftables_rulename_spec.rb
+++ b/spec/type_aliases/nftables_rulename_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'Nftables::RuleName' do
diff --git a/spec/type_aliases/nftables_simplerulename_spec.rb b/spec/type_aliases/nftables_simplerulename_spec.rb
index ccbf1ac..8122684 100644
--- a/spec/type_aliases/nftables_simplerulename_spec.rb
+++ b/spec/type_aliases/nftables_simplerulename_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'Nftables::SimpleRuleName' do
diff --git a/spec/unit/facter/nftables_spec.rb b/spec/unit/facter/nftables_spec.rb
index b2fdf37..6c48ccf 100644
--- a/spec/unit/facter/nftables_spec.rb
+++ b/spec/unit/facter/nftables_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'nftables' do
@@ -14,7 +16,7 @@ describe 'nftables' do
     let(:nft_version_result) { "nftables v0.9.15 (Topsy)\n" }
 
     it 'returns valid fact' do
-      expect(Facter.fact('nftables').value).to eq('tables' => ['inet-firewalld', 'ip-firewalld'], 'version' => '0.9.15')
+      expect(Facter.fact('nftables').value).to eq('tables' => %w[inet-firewalld ip-firewalld], 'version' => '0.9.15')
     end
   end
 
