beaker-pe 3.6.5 → 3.6.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 330fb055e63900ac5bdefd9d48a122eb35a13872c6a820bb072fe88409415ab7
-  data.tar.gz: 17588df9d4e67e74cab914118a35457d66aad62397c6c1194c41eb1ba51e967c
+  metadata.gz: 8c64a23179a869b41ceb2ea32740a983e8a27172939f4347b6401d94265c1f26
+  data.tar.gz: 1f961918eda0b697d7246d4abef2cf451f742a5f816a9667e3d2259ca415d7b9
 SHA512:
-  metadata.gz: 50576aa57b1e28945226720abe0f959cf1c05b56c29e84f61a215b461bb171728b27c0b03eaea233b9da69fc948938536c23ee8057bc7c54f5647c1ef6d6fd94
-  data.tar.gz: 8e5c488e4dbfd2a940f78a7bf434efc5d9fac63ffece679e07d5a078a616c807c480fe234b53d3710bc0b67c447362382abecefa25e14139f5762ba2195bd0b9
+  metadata.gz: '07931522f4f5f30eb04235539a1b9d3d30b3cc16eb551bb7d78b5eed7f010b62b9bcd07de1b15b66be5419bdf273b44c097710484b8976597b8b1ce67efab31c'
+  data.tar.gz: 27cd5ed3c62caa3899b980fd3f63c0c3c5c0c5f5f52e1dca4601d50ba70a7c1132b2dc07a56a019caff526e83cb9c74523dd25c6321cc26fb0463c95344acc7a

data/CHANGELOG.md

@@ -1,28 +1,53 @@
 # Changelog
 
-## [3.6.5](https://github.com/puppetlabs/beaker-pe/tree/3.6.5) (2026-07-29)
+## [3.6.7](https://github.com/puppetlabs/beaker-pe/tree/3.6.7) (2026-08-14)
+
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.6...3.6.7)
+
+**Fixed bugs:**
+
+- \(PE-45827\) Query PuppetDB's unauthenticated status endpoint in check\_puppetdb\_status\_endpoint [\#313](https://github.com/puppetlabs/beaker-pe/pull/313) ([steveax](https://github.com/steveax))
+
+## [3.6.6](https://github.com/puppetlabs/beaker-pe/tree/3.6.6) (2026-08-12)
+
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.5...3.6.6)
+
+**Fixed bugs:**
+
+- \(PE-45827\) Prefer the ssl status endpoint for PuppetDB liveness validation [\#311](https://github.com/puppetlabs/beaker-pe/pull/311) ([jonathannewman](https://github.com/jonathannewman))
+
+## [3.6.5](https://github.com/puppetlabs/beaker-pe/tree/3.6.5) (2026-07-30)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.4...3.6.5)
 
 **Implemented enhancements:**
 
-- (PE-45366) Add pe_run_in_parallel option, serial by default on macOS [#309](https://github.com/puppetlabs/beaker-pe/pull/309) ([Magisus](https://github.com/Magisus))
+- \(PE-45366\) Add pe\_run\_in\_parallel option, serial by default on macOS [\#309](https://github.com/puppetlabs/beaker-pe/pull/309) ([Magisus](https://github.com/Magisus))
+
+**Merged pull requests:**
+
+- \(maint\) prepare for release 3.6.5 [\#310](https://github.com/puppetlabs/beaker-pe/pull/310) ([Magisus](https://github.com/Magisus))
 
 ## [3.6.4](https://github.com/puppetlabs/beaker-pe/tree/3.6.4) (2026-07-23)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.3...3.6.4)
 
-**Fixed bugs:**
+**Merged pull requests:**
 
-- [PE-41009]: Fall back to agent-downloads when promoted agent is missing from the public mirror [#306](https://github.com/puppetlabs/beaker-pe/pull/306) ([Magisus](https://github.com/Magisus))
+- \(maint\) prepare for release 3.6.4 [\#307](https://github.com/puppetlabs/beaker-pe/pull/307) ([Magisus](https://github.com/Magisus))
+- \(PE-41009\) Fall back to agent-downloads when promoted agent is missing from public mirror [\#306](https://github.com/puppetlabs/beaker-pe/pull/306) ([Magisus](https://github.com/Magisus))
 
 ## [3.6.3](https://github.com/puppetlabs/beaker-pe/tree/3.6.3) (2026-07-16)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.2...3.6.3)
 
-**Fixed bugs:**
+**Implemented enhancements:**
 
-- [PE-45082]: Broaden is_expected_pe_postgres_failure? allowlist [#303](https://github.com/puppetlabs/beaker-pe/pull/303) ([steveax](https://github.com/steveax))
+- \(PE-45082\) Broaden is\_expected\_pe\_postgres\_failure? allowlist [\#303](https://github.com/puppetlabs/beaker-pe/pull/303) ([steveax](https://github.com/steveax))
+
+**Merged pull requests:**
+
+- \(maint\) prepare for release 3.6.3 [\#304](https://github.com/puppetlabs/beaker-pe/pull/304) ([steveax](https://github.com/steveax))
 
 ## [3.6.2](https://github.com/puppetlabs/beaker-pe/tree/3.6.2) (2026-06-05)
 
@@ -30,7 +55,7 @@
 
 **Fixed bugs:**
 
-- Add waitforlock flag to second puppet runs to prevent lock collisions [#300](https://github.com/puppetlabs/beaker-pe/pull/300) ([jonathannewman](https://github.com/jonathannewman))
+- Add waitforlock\_flag to second puppet runs to prevent lock collisions [\#300](https://github.com/puppetlabs/beaker-pe/pull/300) ([jonathannewman](https://github.com/jonathannewman))
 
 ## [3.6.1](https://github.com/puppetlabs/beaker-pe/tree/3.6.1) (2025-11-21)
 
@@ -54,15 +79,20 @@
 
 **Implemented enhancements:**
 
-- \(PE-40793\) Follow https->>http redirects [\#287](https://github.com/puppetlabs/beaker-pe/pull/287) ([tvpartytonight](https://github.com/tvpartytonight))
+- \(maint\) prepare for 3.5.0 release [\#288](https://github.com/puppetlabs/beaker-pe/pull/288) ([tvpartytonight](https://github.com/tvpartytonight))
+- \(PE-40793\) Follow https-\>\>http redirects [\#287](https://github.com/puppetlabs/beaker-pe/pull/287) ([tvpartytonight](https://github.com/tvpartytonight))
 
-## [3.4.0](https://github.com/puppetlabs/beaker-pe/tree/3.4.0) (2025-03-12)
+## [3.4.0](https://github.com/puppetlabs/beaker-pe/tree/3.4.0) (2025-03-13)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.3.1...3.4.0)
 
 **Implemented enhancements:**
 
-- \(PE-40143\) Add ruby 3.2 support [\#285](https://github.com/puppetlabs/beaker-pe/pull/285) ([tvpartytonight](https://github.com/tvpartytonight))
+- \(PE-40143\) Update beaker-pe for ruby 3.2 compatibility [\#285](https://github.com/puppetlabs/beaker-pe/pull/285) ([tvpartytonight](https://github.com/tvpartytonight))
+
+**Merged pull requests:**
+
+- \(maint\) prep for 3.4.0 release [\#286](https://github.com/puppetlabs/beaker-pe/pull/286) ([tvpartytonight](https://github.com/tvpartytonight))
 
 ## [3.3.1](https://github.com/puppetlabs/beaker-pe/tree/3.3.1) (2024-12-05)
 
@@ -728,7 +758,7 @@
 **Merged pull requests:**
 
 - PE-11351 clear puppet jenkins slaves [\#98](https://github.com/puppetlabs/beaker-pe/pull/98) ([mwbutcher](https://github.com/mwbutcher))
-- \(maint\) Add beaker-abs to gemspec [\#97](https://github.com/puppetlabs/beaker-pe/pull/97) ([smcelmurry](https://github.com/smcelmurry))
+- \(maint\) Add beaker-abs to gemspec [\#97](https://github.com/puppetlabs/beaker-pe/pull/97) ([junebug-spencer](https://github.com/junebug-spencer))
 - \(RE-9922\) Migrate from stickler to artifactory [\#96](https://github.com/puppetlabs/beaker-pe/pull/96) ([sarameisburger](https://github.com/sarameisburger))
 
 ## [1.32.0](https://github.com/puppetlabs/beaker-pe/tree/1.32.0) (2018-01-09)
@@ -799,7 +829,6 @@
 
 - Fix agent installation failure caused by previous commit [\#87](https://github.com/puppetlabs/beaker-pe/pull/87) ([shaigy](https://github.com/shaigy))
 - PE-22051 Changes for adding loadbalancer to LEI job [\#86](https://github.com/puppetlabs/beaker-pe/pull/86) ([shaigy](https://github.com/shaigy))
-- \(MAINT\) Fix linux masterless installation [\#70](https://github.com/puppetlabs/beaker-pe/pull/70) ([Renelast](https://github.com/Renelast))
 
 ## [1.23.0](https://github.com/puppetlabs/beaker-pe/tree/1.23.0) (2017-09-15)
 
@@ -1153,7 +1182,6 @@
 
 - \(maint\) Remove leftover comments [\#7](https://github.com/puppetlabs/beaker-pe/pull/7) ([tvpartytonight](https://github.com/tvpartytonight))
 - BKR-656 [\#6](https://github.com/puppetlabs/beaker-pe/pull/6) ([tvpartytonight](https://github.com/tvpartytonight))
-- Fixes windows masterless installation [\#1](https://github.com/puppetlabs/beaker-pe/pull/1) ([Renelast](https://github.com/Renelast))
 
 ## [0.1.2](https://github.com/puppetlabs/beaker-pe/tree/0.1.2) (2016-04-05)
 

data/lib/beaker-pe/install/pe_utils.rb

@@ -1840,11 +1840,43 @@ EOM
           if version_is_less(host['pe_ver'], '2016.1.0')
             return true
           end
+
+          ssl_port = options[:puppetdb_port_ssl] || 8081
+          nonssl_port = options[:puppetdb_port_nonssl] || 8080
+
           Timeout.timeout(60) do
             match = nil
             while not match
-              output = on(host, "curl -s http://localhost:8080/pdb/meta/v1/version", :accept_all_exit_codes => true)
-              match = output.stdout =~ /version.*\d+\.\d+\.\d+/
+              # Prefer the ssl status endpoint. PuppetDB's jetty listener is
+              # explicitly configured with `client-auth = want`, not `need`
+              # (see puppet_enterprise::puppetdb::jetty_ini.pp), and
+              # /status/v1/* is allow-unauthenticated in PuppetDB's auth.conf,
+              # so `curl -k` gets a real, content-validated response with no
+              # client cert needed. This is the only path that still works
+              # once the cleartext listener is disabled by default
+              # (PE-45384/PE-44906, SECVULN-1792).
+              #
+              # NB: /pdb/meta/v1/version is NOT allow-unauthenticated -- it
+              # requires a cert or token, so a bare `curl -k` against it is
+              # rejected with "Must supply a certificate or token". PE-45827
+              # switched this check to ssl but kept /pdb/meta/v1/version, so it
+              # still hard-failed ("PuppetDB took too long to start") on
+              # cleartext-disabled upgrade hosts. Query the status endpoint and
+              # validate the running state instead, matching the working
+              # sleep_until_puppetdb_started (beaker-puppet, PE-45697). PE-45827.
+              status_endpoint = "status/v1/services/puppetdb-status"
+              running = /"state"\s*:\s*"running"/
+              output = on(host, "curl -s -k https://localhost:#{ssl_port}/#{status_endpoint}", :accept_all_exit_codes => true)
+              match = output.stdout =~ running
+
+              # Fall back to the cleartext port for older or nonstandard
+              # configurations where the ssl endpoint doesn't behave as
+              # above.
+              if !match
+                output = on(host, "curl -s http://localhost:#{nonssl_port}/#{status_endpoint}", :accept_all_exit_codes => true)
+                match = output.stdout =~ running
+              end
+
               sleep 1
             end
           end

data/lib/beaker-pe/version.rb

@@ -3,7 +3,7 @@ module Beaker
     module PE
 
       module Version
-        STRING = '3.6.5'
+        STRING = '3.6.7'
       end
 
     end

data/spec/beaker-pe/install/pe_utils_spec.rb

@@ -2663,6 +2663,49 @@ NOASK
     end
   end
 
+  describe '#check_puppetdb_status_endpoint' do
+    it 'does not do anything if version is less than 2016.1.0' do
+      allow(subject).to receive(:version_is_less).and_return(true)
+
+      expect(subject).not_to receive(:on)
+      subject.check_puppetdb_status_endpoint(unixhost)
+    end
+
+    it 'queries the allow-unauthenticated ssl status endpoint, not /pdb/meta (PE-45827)' do
+      allow(subject).to receive(:version_is_less).and_return(false)
+      allow(subject).to receive(:sleep)
+      ssl_result = double(Beaker::Result, :stdout => '{"puppetdb-status":{"state":"running"}}', :exit_code => 0)
+      expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/status/v1/services/puppetdb-status}, anything).once.and_return(ssl_result)
+      expect(subject).not_to receive(:on).with(anything, %r{/pdb/meta/}, anything)
+      expect(subject).not_to receive(:on).with(anything, %r{http://localhost:8080/}, anything)
+
+      expect { subject.check_puppetdb_status_endpoint(unixhost) }.not_to raise_error
+    end
+
+    context 'when the ssl endpoint never returns a running state (older or nonstandard config)' do
+      it 'falls back to the cleartext status endpoint' do
+        allow(subject).to receive(:version_is_less).and_return(false)
+        allow(subject).to receive(:sleep)
+        ssl_result = double(Beaker::Result, :stdout => '', :exit_code => 0)
+        nonssl_result = double(Beaker::Result, :stdout => '{"puppetdb-status":{"state":"running"}}', :exit_code => 0)
+        expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/status/v1/services/puppetdb-status}, anything).once.ordered.and_return(ssl_result)
+        expect(subject).to receive(:on).with(anything, %r{http://localhost:8080/status/v1/services/puppetdb-status}, anything).once.ordered.and_return(nonssl_result)
+
+        expect { subject.check_puppetdb_status_endpoint(unixhost) }.not_to raise_error
+      end
+    end
+
+    context 'when neither endpoint ever returns valid content' do
+      it 'still fails the test, preserving the original PE-14934 race guard' do
+        allow(subject).to receive(:version_is_less).and_return(false)
+        allow(Timeout).to receive(:timeout).and_raise(Timeout::Error)
+        expect(subject).to receive(:fail_test).with('PuppetDB took too long to start')
+
+        subject.check_puppetdb_status_endpoint(unixhost)
+      end
+    end
+  end
+
   describe '#get_puppet_agent_version' do
 
     context 'when the puppet_agent version is set on an argument' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: beaker-pe
 version: !ruby/object:Gem::Version
-  version: 3.6.5
+  version: 3.6.7
 platform: ruby
 authors:
 - Puppetlabs