beaker-pe 3.6.4 → 3.6.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17f39948dbc58217035cd4e93469070ac5f35309dc2078fb3995e7edc6558d7f
-  data.tar.gz: 65d1131709c2e886a82dc29f74a7f5a9907f89b2da0fc799233f325954069193
+  metadata.gz: aa8b72f2297a472ddc6291dd99dba0607bee54af45ebf9599675aac36823ecc7
+  data.tar.gz: 8186462c53f80d68b4d0c19c46d1fafdb24bd4af604b18d2b40a3ca0820dbf23
 SHA512:
-  metadata.gz: bef219e4d18d83b1663764cb203cdeb1f857a889d602e4b22d91e1a47c9d96019a169bc8265cf67d485f3082bd67704e7454bc2caf5dff8548bf333be7fcda23
-  data.tar.gz: 420a8f53c44f65636413a31b292b8f510369a740fa619c9c163143e4af02f0de115c7fca9c9bae7cf29d4a63a94a103cf8fd8d26cc4048e6202a4292a1194248
+  metadata.gz: 723ce4a758aaa6cfd40b907ae7a6877349d6402393e445b9a9f147437d60db22d64d9ef29f795884f0f16a9b07c8cb566e9a9bcf50383cfd1819266a59ef0d6d
+  data.tar.gz: b862c17a232e7c30b7d5d623a0d947a0cf95c58554722f76cba6f5f23e5b60a224e30ba0ca04fa2f8058192b0ab46b831d101831fb894ea9270d745fe839d16e

data/CHANGELOG.md

@@ -1,20 +1,45 @@
 # Changelog
 
+## [3.6.6](https://github.com/puppetlabs/beaker-pe/tree/3.6.6) (2026-08-12)
+
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.5...3.6.6)
+
+**Fixed bugs:**
+
+- \(PE-45827\) Prefer the ssl status endpoint for PuppetDB liveness validation [\#311](https://github.com/puppetlabs/beaker-pe/pull/311) ([jonathannewman](https://github.com/jonathannewman))
+
+## [3.6.5](https://github.com/puppetlabs/beaker-pe/tree/3.6.5) (2026-07-30)
+
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.4...3.6.5)
+
+**Implemented enhancements:**
+
+- \(PE-45366\) Add pe\_run\_in\_parallel option, serial by default on macOS [\#309](https://github.com/puppetlabs/beaker-pe/pull/309) ([Magisus](https://github.com/Magisus))
+
+**Merged pull requests:**
+
+- \(maint\) prepare for release 3.6.5 [\#310](https://github.com/puppetlabs/beaker-pe/pull/310) ([Magisus](https://github.com/Magisus))
+
 ## [3.6.4](https://github.com/puppetlabs/beaker-pe/tree/3.6.4) (2026-07-23)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.3...3.6.4)
 
-**Fixed bugs:**
+**Merged pull requests:**
 
-- [PE-41009]: Fall back to agent-downloads when promoted agent is missing from the public mirror [#306](https://github.com/puppetlabs/beaker-pe/pull/306) ([Magisus](https://github.com/Magisus))
+- \(maint\) prepare for release 3.6.4 [\#307](https://github.com/puppetlabs/beaker-pe/pull/307) ([Magisus](https://github.com/Magisus))
+- \(PE-41009\) Fall back to agent-downloads when promoted agent is missing from public mirror [\#306](https://github.com/puppetlabs/beaker-pe/pull/306) ([Magisus](https://github.com/Magisus))
 
 ## [3.6.3](https://github.com/puppetlabs/beaker-pe/tree/3.6.3) (2026-07-16)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.2...3.6.3)
 
-**Fixed bugs:**
+**Implemented enhancements:**
 
-- [PE-45082]: Broaden is_expected_pe_postgres_failure? allowlist [#303](https://github.com/puppetlabs/beaker-pe/pull/303) ([steveax](https://github.com/steveax))
+- \(PE-45082\) Broaden is\_expected\_pe\_postgres\_failure? allowlist [\#303](https://github.com/puppetlabs/beaker-pe/pull/303) ([steveax](https://github.com/steveax))
+
+**Merged pull requests:**
+
+- \(maint\) prepare for release 3.6.3 [\#304](https://github.com/puppetlabs/beaker-pe/pull/304) ([steveax](https://github.com/steveax))
 
 ## [3.6.2](https://github.com/puppetlabs/beaker-pe/tree/3.6.2) (2026-06-05)
 
@@ -22,7 +47,7 @@
 
 **Fixed bugs:**
 
-- Add waitforlock flag to second puppet runs to prevent lock collisions [#300](https://github.com/puppetlabs/beaker-pe/pull/300) ([jonathannewman](https://github.com/jonathannewman))
+- Add waitforlock\_flag to second puppet runs to prevent lock collisions [\#300](https://github.com/puppetlabs/beaker-pe/pull/300) ([jonathannewman](https://github.com/jonathannewman))
 
 ## [3.6.1](https://github.com/puppetlabs/beaker-pe/tree/3.6.1) (2025-11-21)
 
@@ -46,15 +71,20 @@
 
 **Implemented enhancements:**
 
-- \(PE-40793\) Follow https->>http redirects [\#287](https://github.com/puppetlabs/beaker-pe/pull/287) ([tvpartytonight](https://github.com/tvpartytonight))
+- \(maint\) prepare for 3.5.0 release [\#288](https://github.com/puppetlabs/beaker-pe/pull/288) ([tvpartytonight](https://github.com/tvpartytonight))
+- \(PE-40793\) Follow https-\>\>http redirects [\#287](https://github.com/puppetlabs/beaker-pe/pull/287) ([tvpartytonight](https://github.com/tvpartytonight))
 
-## [3.4.0](https://github.com/puppetlabs/beaker-pe/tree/3.4.0) (2025-03-12)
+## [3.4.0](https://github.com/puppetlabs/beaker-pe/tree/3.4.0) (2025-03-13)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.3.1...3.4.0)
 
 **Implemented enhancements:**
 
-- \(PE-40143\) Add ruby 3.2 support [\#285](https://github.com/puppetlabs/beaker-pe/pull/285) ([tvpartytonight](https://github.com/tvpartytonight))
+- \(PE-40143\) Update beaker-pe for ruby 3.2 compatibility [\#285](https://github.com/puppetlabs/beaker-pe/pull/285) ([tvpartytonight](https://github.com/tvpartytonight))
+
+**Merged pull requests:**
+
+- \(maint\) prep for 3.4.0 release [\#286](https://github.com/puppetlabs/beaker-pe/pull/286) ([tvpartytonight](https://github.com/tvpartytonight))
 
 ## [3.3.1](https://github.com/puppetlabs/beaker-pe/tree/3.3.1) (2024-12-05)
 
@@ -720,7 +750,7 @@
 **Merged pull requests:**
 
 - PE-11351 clear puppet jenkins slaves [\#98](https://github.com/puppetlabs/beaker-pe/pull/98) ([mwbutcher](https://github.com/mwbutcher))
-- \(maint\) Add beaker-abs to gemspec [\#97](https://github.com/puppetlabs/beaker-pe/pull/97) ([smcelmurry](https://github.com/smcelmurry))
+- \(maint\) Add beaker-abs to gemspec [\#97](https://github.com/puppetlabs/beaker-pe/pull/97) ([junebug-spencer](https://github.com/junebug-spencer))
 - \(RE-9922\) Migrate from stickler to artifactory [\#96](https://github.com/puppetlabs/beaker-pe/pull/96) ([sarameisburger](https://github.com/sarameisburger))
 
 ## [1.32.0](https://github.com/puppetlabs/beaker-pe/tree/1.32.0) (2018-01-09)
@@ -791,7 +821,6 @@
 
 - Fix agent installation failure caused by previous commit [\#87](https://github.com/puppetlabs/beaker-pe/pull/87) ([shaigy](https://github.com/shaigy))
 - PE-22051 Changes for adding loadbalancer to LEI job [\#86](https://github.com/puppetlabs/beaker-pe/pull/86) ([shaigy](https://github.com/shaigy))
-- \(MAINT\) Fix linux masterless installation [\#70](https://github.com/puppetlabs/beaker-pe/pull/70) ([Renelast](https://github.com/Renelast))
 
 ## [1.23.0](https://github.com/puppetlabs/beaker-pe/tree/1.23.0) (2017-09-15)
 
@@ -1145,7 +1174,6 @@
 
 - \(maint\) Remove leftover comments [\#7](https://github.com/puppetlabs/beaker-pe/pull/7) ([tvpartytonight](https://github.com/tvpartytonight))
 - BKR-656 [\#6](https://github.com/puppetlabs/beaker-pe/pull/6) ([tvpartytonight](https://github.com/tvpartytonight))
-- Fixes windows masterless installation [\#1](https://github.com/puppetlabs/beaker-pe/pull/1) ([Renelast](https://github.com/Renelast))
 
 ## [0.1.2](https://github.com/puppetlabs/beaker-pe/tree/0.1.2) (2016-04-05)
 

data/README.md

@@ -31,6 +31,27 @@ of key concepts.
 involved in addressing key problems and use-cases. For instance, checkout our
 [How-to Install Puppet Enterprise doc](docs/how_to/install_puppet_enterprise.md).
 
+## Configuration
+
+### Running install/upgrade steps serially (`pe_run_in_parallel`)
+
+Several PE install/upgrade steps act on many hosts at once by `fork()`ing a child
+process per host, each with its own SSH connection. **On macOS, forking a Ruby
+process that has already used `Net::SSH` deadlocks the child**, so these steps hang
+until beaker's watchdog kills them (`RuntimeError: Child process ran longer than
+timeout of 1800`). This does not happen on Linux/CI.
+
+Because of this, beaker-pe defaults to running these steps **serially on macOS** and
+**in parallel on every other platform**. You can override the default either way:
+
+- Option: set `pe_run_in_parallel: true` (or `false`) in your beaker options.
+- Env var: `export BEAKER_PE_RUN_IN_PARALLEL=1` (or `0`) before running beaker.
+
+Precedence, highest first: the `BEAKER_PE_RUN_IN_PARALLEL` env var, then the
+`pe_run_in_parallel` option, then the platform default (`false` on macOS, `true`
+elsewhere). For the env var, `1`, `true`, or `yes` force parallel; `0`, `false`, or
+`no` force serial.
+
 ## Upgrading from 0.y to 1.y?
 
 If you've used beaker-pe previously (during the 0.y versions), you'll

data/lib/beaker-pe/install/pe_utils.rb

@@ -1519,12 +1519,27 @@ NOASK
             (host['platform'] =~ /windows-2008r2/ && (!version_is_less(host['pe_ver'], '2016.4.99') && version_is_less(host['pe_ver'], '2016.5.99') && !version_is_less(host['pe_ver'], '3.99')))
         end
 
+        # Whether PE install/upgrade steps that act on many hosts should fork and
+        # run in parallel. Forking + Net::SSH deadlocks on macOS, so the default is
+        # serial there and parallel everywhere else; a developer can override either
+        # way. Precedence, highest first:
+        #   BEAKER_PE_RUN_IN_PARALLEL env var > :pe_run_in_parallel option > default
+        #   (false on macOS, true elsewhere)
+        # @api private
+        # @return [Boolean]
+        def pe_run_in_parallel?
+          env = ENV['BEAKER_PE_RUN_IN_PARALLEL']
+          return %w[1 true yes].include?(env.downcase) unless env.nil? || env.empty?
+          opt = options[:pe_run_in_parallel]
+          opt.nil? ? (RUBY_PLATFORM !~ /darwin/) : !!opt
+        end
+
         # Runs puppet on all nodes, unless they have the roles: master,database,console/dashboard
         # @param [Array<Host>] hosts The sorted hosts to install or upgrade PE on
         def run_puppet_on_non_infrastructure_nodes(all_hosts)
           pe_infrastructure = select_hosts({:roles => ['master', 'compile_master', 'pe_compiler', 'dashboard', 'database']}, all_hosts)
           non_infrastructure = all_hosts.reject{|host| pe_infrastructure.include? host}
-          on non_infrastructure, puppet_agent('-t'), :acceptable_exit_codes => [0,2], :run_in_parallel => true
+          on non_infrastructure, puppet_agent('-t'), :acceptable_exit_codes => [0,2], :run_in_parallel => pe_run_in_parallel?
         end
 
         # Whether or not PE should be managing the puppet service on agents.
@@ -1825,11 +1840,33 @@ EOM
           if version_is_less(host['pe_ver'], '2016.1.0')
             return true
           end
+
+          ssl_port = options[:puppetdb_port_ssl] || 8081
+          nonssl_port = options[:puppetdb_port_nonssl] || 8080
+
           Timeout.timeout(60) do
             match = nil
             while not match
-              output = on(host, "curl -s http://localhost:8080/pdb/meta/v1/version", :accept_all_exit_codes => true)
+              # Prefer the ssl status endpoint. PuppetDB's jetty listener is
+              # explicitly configured with `client-auth = want`, not `need`
+              # (see puppet_enterprise::puppetdb::jetty_ini.pp), and
+              # /pdb/meta/v1/version -- like the rest of /status/v1/* -- is
+              # allow-unauthenticated in PuppetDB's auth.conf. So `curl -k`
+              # gets a real, validated response with no client cert needed,
+              # and it's the only path that still works once the cleartext
+              # listener is disabled by default (PE-45384/PE-44906,
+              # SECVULN-1792; PE-45827).
+              output = on(host, "curl -s -k https://localhost:#{ssl_port}/pdb/meta/v1/version", :accept_all_exit_codes => true)
               match = output.stdout =~ /version.*\d+\.\d+\.\d+/
+
+              # Fall back to the cleartext port for older or nonstandard
+              # configurations where the ssl endpoint doesn't behave as
+              # above.
+              if !match
+                output = on(host, "curl -s http://localhost:#{nonssl_port}/pdb/meta/v1/version", :accept_all_exit_codes => true)
+                match = output.stdout =~ /version.*\d+\.\d+\.\d+/
+              end
+
               sleep 1
             end
           end
@@ -2133,7 +2170,7 @@ EOM
           end
 
           step "Stop agent service on infrastructure nodes" do
-            stop_agent_on(pe_infrastructure, :run_in_parallel => true)
+            stop_agent_on(pe_infrastructure, :run_in_parallel => pe_run_in_parallel?)
           end
 
           # waitforlock in case stopping the agent run after stopping the agent service
@@ -2488,7 +2525,7 @@ EOM
             end
 
              step "Install agents" do
-               block_on(agent_nodes, {:run_in_parallel => true}) do |host|
+               block_on(agent_nodes, {:run_in_parallel => pe_run_in_parallel?}) do |host|
                  install_ca_cert_on(host, opts)
                  on(host, installer_cmd(host, opts))
                end
@@ -2500,13 +2537,13 @@ EOM
              end
 
              step "Stop puppet agents to avoid interfering with tests" do
-               stop_agent_on(agent_nodes, :run_in_parallel => true)
+               stop_agent_on(agent_nodes, :run_in_parallel => pe_run_in_parallel?)
              end
 
              # waitforlock in case stopping the agent run after stopping the agent service
              # takes a little longer than usual
              step "Run puppet on all agent nodes" do
-               block_on(agent_nodes, {:run_in_parallel => true}) do |host|
+               block_on(agent_nodes, {:run_in_parallel => pe_run_in_parallel?}) do |host|
                  on host, puppet_agent("-t #{waitforlock_flag(host)}"), :acceptable_exit_codes => [0,2]
                end
              end

data/lib/beaker-pe/version.rb

@@ -3,7 +3,7 @@ module Beaker
     module PE
 
       module Version
-        STRING = '3.6.4'
+        STRING = '3.6.6'
       end
 
     end

data/spec/beaker-pe/install/pe_utils_spec.rb

@@ -25,6 +25,17 @@ class ClassMixedWithDSLInstallUtils
 end
 
 describe ClassMixedWithDSLInstallUtils do
+  # Neutralize BEAKER_PE_RUN_IN_PARALLEL and pin RUBY_PLATFORM to a non-macOS value
+  # for every example in this file, so that pre-existing specs asserting the default
+  # (:run_in_parallel => true) are not affected by whatever a developer happens to
+  # have exported in their shell or by running the suite on a Mac (where the default
+  # is serial). Examples that exercise the macOS default stub RUBY_PLATFORM to darwin.
+  before do
+    allow(ENV).to receive(:[]).and_call_original
+    allow(ENV).to receive(:[]).with('BEAKER_PE_RUN_IN_PARALLEL').and_return(nil)
+    stub_const('RUBY_PLATFORM', 'x86_64-linux')
+  end
+
   let(:presets)       { Beaker::Options::Presets.new }
   let(:opts)          { presets.presets.merge(presets.env_vars) }
   let(:basic_hosts)   { make_hosts( { :pe_ver => '3.0',
@@ -612,6 +623,35 @@ describe ClassMixedWithDSLInstallUtils do
     end
   end
 
+  describe '#run_puppet_on_non_infrastructure_nodes parallel wiring' do
+    let(:master)   { make_host('master', :pe_ver => '2016.4', :platform => 'el-7-x86_64', :roles => ['master', 'database', 'dashboard']) }
+    let(:el_agent) { make_host('agent', :pe_ver => '2016.4', :platform => 'el-7-x86_64', :roles => ['frictionless']) }
+
+    before do
+      allow(ENV).to receive(:[]).and_call_original
+      allow(ENV).to receive(:[]).with('BEAKER_PE_RUN_IN_PARALLEL').and_return(nil)
+    end
+
+    it 'passes run_in_parallel => false when the option disables it' do
+      subject.options[:pe_run_in_parallel] = false
+      expect(subject).to receive(:on).with(
+        [el_agent],
+        anything,
+        hash_including(:run_in_parallel => false)
+      ).once
+      subject.run_puppet_on_non_infrastructure_nodes([master, el_agent])
+    end
+
+    it 'passes run_in_parallel => true by default' do
+      expect(subject).to receive(:on).with(
+        [el_agent],
+        anything,
+        hash_including(:run_in_parallel => true)
+      ).once
+      subject.run_puppet_on_non_infrastructure_nodes([master, el_agent])
+    end
+  end
+
   describe 'install_via_msi?' do
     it 'returns true if pe_version is before PE 2016.4.0' do
       the_host = winhost.dup
@@ -661,6 +701,71 @@ describe ClassMixedWithDSLInstallUtils do
 
   end
 
+  describe '#pe_run_in_parallel?' do
+    before do
+      # Default: pretend the env var is unset unless a specific example sets it.
+      allow(ENV).to receive(:[]).and_call_original
+      allow(ENV).to receive(:[]).with('BEAKER_PE_RUN_IN_PARALLEL').and_return(nil)
+    end
+
+    context 'with no option and no env var' do
+      it 'defaults to true off macOS' do
+        stub_const('RUBY_PLATFORM', 'x86_64-linux')
+        expect(subject.send(:pe_run_in_parallel?)).to eq(true)
+      end
+
+      it 'defaults to false on macOS' do
+        stub_const('RUBY_PLATFORM', 'x86_64-darwin21')
+        expect(subject.send(:pe_run_in_parallel?)).to eq(false)
+      end
+    end
+
+    context 'with the :pe_run_in_parallel option' do
+      it 'returns false when the option is false' do
+        subject.options[:pe_run_in_parallel] = false
+        expect(subject.send(:pe_run_in_parallel?)).to eq(false)
+      end
+
+      it 'returns true when the option is true' do
+        subject.options[:pe_run_in_parallel] = true
+        expect(subject.send(:pe_run_in_parallel?)).to eq(true)
+      end
+    end
+
+    context 'with the BEAKER_PE_RUN_IN_PARALLEL env var set' do
+      %w[1 true yes TRUE Yes].each do |truthy|
+        it "returns true for #{truthy.inspect}" do
+          allow(ENV).to receive(:[]).with('BEAKER_PE_RUN_IN_PARALLEL').and_return(truthy)
+          expect(subject.send(:pe_run_in_parallel?)).to eq(true)
+        end
+      end
+
+      %w[0 false no off].each do |falsey|
+        it "returns false for #{falsey.inspect}" do
+          allow(ENV).to receive(:[]).with('BEAKER_PE_RUN_IN_PARALLEL').and_return(falsey)
+          expect(subject.send(:pe_run_in_parallel?)).to eq(false)
+        end
+      end
+
+      it 'overrides the option (env true beats option false)' do
+        subject.options[:pe_run_in_parallel] = false
+        allow(ENV).to receive(:[]).with('BEAKER_PE_RUN_IN_PARALLEL').and_return('1')
+        expect(subject.send(:pe_run_in_parallel?)).to eq(true)
+      end
+
+      it 'overrides the option (env false beats option true)' do
+        subject.options[:pe_run_in_parallel] = true
+        allow(ENV).to receive(:[]).with('BEAKER_PE_RUN_IN_PARALLEL').and_return('0')
+        expect(subject.send(:pe_run_in_parallel?)).to eq(false)
+      end
+
+      it 'falls through to the default when the env var is empty' do
+        allow(ENV).to receive(:[]).with('BEAKER_PE_RUN_IN_PARALLEL').and_return('')
+        expect(subject.send(:pe_run_in_parallel?)).to eq(true)
+      end
+    end
+  end
+
   describe 'higgs installer' do
     let(:host) { unixhost }
     let(:higgs_regex) { %r{cd .* ; nohup \./puppet-enterprise-installer <<<#{higgs_answer} .*} }
@@ -2558,6 +2663,48 @@ NOASK
     end
   end
 
+  describe '#check_puppetdb_status_endpoint' do
+    it 'does not do anything if version is less than 2016.1.0' do
+      allow(subject).to receive(:version_is_less).and_return(true)
+
+      expect(subject).not_to receive(:on)
+      subject.check_puppetdb_status_endpoint(unixhost)
+    end
+
+    it 'succeeds via the ssl endpoint alone, without ever falling back to cleartext (PE-45827)' do
+      allow(subject).to receive(:version_is_less).and_return(false)
+      allow(subject).to receive(:sleep)
+      ssl_result = double(Beaker::Result, :stdout => '{"version":"7.12.1"}', :exit_code => 0)
+      expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/}, anything).once.and_return(ssl_result)
+      expect(subject).not_to receive(:on).with(anything, %r{http://localhost:8080/}, anything)
+
+      expect { subject.check_puppetdb_status_endpoint(unixhost) }.not_to raise_error
+    end
+
+    context 'when the ssl endpoint never returns valid content (older or nonstandard config)' do
+      it 'falls back to the cleartext endpoint' do
+        allow(subject).to receive(:version_is_less).and_return(false)
+        allow(subject).to receive(:sleep)
+        ssl_result = double(Beaker::Result, :stdout => '', :exit_code => 0)
+        nonssl_result = double(Beaker::Result, :stdout => '{"version":"7.12.1"}', :exit_code => 0)
+        expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/}, anything).once.ordered.and_return(ssl_result)
+        expect(subject).to receive(:on).with(anything, %r{http://localhost:8080/}, anything).once.ordered.and_return(nonssl_result)
+
+        expect { subject.check_puppetdb_status_endpoint(unixhost) }.not_to raise_error
+      end
+    end
+
+    context 'when neither endpoint ever returns valid content' do
+      it 'still fails the test, preserving the original PE-14934 race guard' do
+        allow(subject).to receive(:version_is_less).and_return(false)
+        allow(Timeout).to receive(:timeout).and_raise(Timeout::Error)
+        expect(subject).to receive(:fail_test).with('PuppetDB took too long to start')
+
+        subject.check_puppetdb_status_endpoint(unixhost)
+      end
+    end
+  end
+
   describe '#get_puppet_agent_version' do
 
     context 'when the puppet_agent version is set on an argument' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: beaker-pe
 version: !ruby/object:Gem::Version
-  version: 3.6.4
+  version: 3.6.6
 platform: ruby
 authors:
 - Puppetlabs