beaker-pe 3.6.6 → 3.6.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aa8b72f2297a472ddc6291dd99dba0607bee54af45ebf9599675aac36823ecc7
-  data.tar.gz: 8186462c53f80d68b4d0c19c46d1fafdb24bd4af604b18d2b40a3ca0820dbf23
+  metadata.gz: 8c64a23179a869b41ceb2ea32740a983e8a27172939f4347b6401d94265c1f26
+  data.tar.gz: 1f961918eda0b697d7246d4abef2cf451f742a5f816a9667e3d2259ca415d7b9
 SHA512:
-  metadata.gz: 723ce4a758aaa6cfd40b907ae7a6877349d6402393e445b9a9f147437d60db22d64d9ef29f795884f0f16a9b07c8cb566e9a9bcf50383cfd1819266a59ef0d6d
-  data.tar.gz: b862c17a232e7c30b7d5d623a0d947a0cf95c58554722f76cba6f5f23e5b60a224e30ba0ca04fa2f8058192b0ab46b831d101831fb894ea9270d745fe839d16e
+  metadata.gz: '07931522f4f5f30eb04235539a1b9d3d30b3cc16eb551bb7d78b5eed7f010b62b9bcd07de1b15b66be5419bdf273b44c097710484b8976597b8b1ce67efab31c'
+  data.tar.gz: 27cd5ed3c62caa3899b980fd3f63c0c3c5c0c5f5f52e1dca4601d50ba70a7c1132b2dc07a56a019caff526e83cb9c74523dd25c6321cc26fb0463c95344acc7a

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [3.6.7](https://github.com/puppetlabs/beaker-pe/tree/3.6.7) (2026-08-14)
+
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.6...3.6.7)
+
+**Fixed bugs:**
+
+- \(PE-45827\) Query PuppetDB's unauthenticated status endpoint in check\_puppetdb\_status\_endpoint [\#313](https://github.com/puppetlabs/beaker-pe/pull/313) ([steveax](https://github.com/steveax))
+
 ## [3.6.6](https://github.com/puppetlabs/beaker-pe/tree/3.6.6) (2026-08-12)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.5...3.6.6)

data/lib/beaker-pe/install/pe_utils.rb

@@ -1850,21 +1850,31 @@ EOM
               # Prefer the ssl status endpoint. PuppetDB's jetty listener is
               # explicitly configured with `client-auth = want`, not `need`
               # (see puppet_enterprise::puppetdb::jetty_ini.pp), and
-              # /pdb/meta/v1/version -- like the rest of /status/v1/* -- is
-              # allow-unauthenticated in PuppetDB's auth.conf. So `curl -k`
-              # gets a real, validated response with no client cert needed,
-              # and it's the only path that still works once the cleartext
-              # listener is disabled by default (PE-45384/PE-44906,
-              # SECVULN-1792; PE-45827).
-              output = on(host, "curl -s -k https://localhost:#{ssl_port}/pdb/meta/v1/version", :accept_all_exit_codes => true)
-              match = output.stdout =~ /version.*\d+\.\d+\.\d+/
+              # /status/v1/* is allow-unauthenticated in PuppetDB's auth.conf,
+              # so `curl -k` gets a real, content-validated response with no
+              # client cert needed. This is the only path that still works
+              # once the cleartext listener is disabled by default
+              # (PE-45384/PE-44906, SECVULN-1792).
+              #
+              # NB: /pdb/meta/v1/version is NOT allow-unauthenticated -- it
+              # requires a cert or token, so a bare `curl -k` against it is
+              # rejected with "Must supply a certificate or token". PE-45827
+              # switched this check to ssl but kept /pdb/meta/v1/version, so it
+              # still hard-failed ("PuppetDB took too long to start") on
+              # cleartext-disabled upgrade hosts. Query the status endpoint and
+              # validate the running state instead, matching the working
+              # sleep_until_puppetdb_started (beaker-puppet, PE-45697). PE-45827.
+              status_endpoint = "status/v1/services/puppetdb-status"
+              running = /"state"\s*:\s*"running"/
+              output = on(host, "curl -s -k https://localhost:#{ssl_port}/#{status_endpoint}", :accept_all_exit_codes => true)
+              match = output.stdout =~ running
 
               # Fall back to the cleartext port for older or nonstandard
               # configurations where the ssl endpoint doesn't behave as
               # above.
               if !match
-                output = on(host, "curl -s http://localhost:#{nonssl_port}/pdb/meta/v1/version", :accept_all_exit_codes => true)
-                match = output.stdout =~ /version.*\d+\.\d+\.\d+/
+                output = on(host, "curl -s http://localhost:#{nonssl_port}/#{status_endpoint}", :accept_all_exit_codes => true)
+                match = output.stdout =~ running
               end
 
               sleep 1

data/lib/beaker-pe/version.rb

@@ -3,7 +3,7 @@ module Beaker
     module PE
 
       module Version
-        STRING = '3.6.6'
+        STRING = '3.6.7'
       end
 
     end

data/spec/beaker-pe/install/pe_utils_spec.rb

@@ -2671,24 +2671,25 @@ NOASK
       subject.check_puppetdb_status_endpoint(unixhost)
     end
 
-    it 'succeeds via the ssl endpoint alone, without ever falling back to cleartext (PE-45827)' do
+    it 'queries the allow-unauthenticated ssl status endpoint, not /pdb/meta (PE-45827)' do
       allow(subject).to receive(:version_is_less).and_return(false)
       allow(subject).to receive(:sleep)
-      ssl_result = double(Beaker::Result, :stdout => '{"version":"7.12.1"}', :exit_code => 0)
-      expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/}, anything).once.and_return(ssl_result)
+      ssl_result = double(Beaker::Result, :stdout => '{"puppetdb-status":{"state":"running"}}', :exit_code => 0)
+      expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/status/v1/services/puppetdb-status}, anything).once.and_return(ssl_result)
+      expect(subject).not_to receive(:on).with(anything, %r{/pdb/meta/}, anything)
       expect(subject).not_to receive(:on).with(anything, %r{http://localhost:8080/}, anything)
 
       expect { subject.check_puppetdb_status_endpoint(unixhost) }.not_to raise_error
     end
 
-    context 'when the ssl endpoint never returns valid content (older or nonstandard config)' do
-      it 'falls back to the cleartext endpoint' do
+    context 'when the ssl endpoint never returns a running state (older or nonstandard config)' do
+      it 'falls back to the cleartext status endpoint' do
         allow(subject).to receive(:version_is_less).and_return(false)
         allow(subject).to receive(:sleep)
         ssl_result = double(Beaker::Result, :stdout => '', :exit_code => 0)
-        nonssl_result = double(Beaker::Result, :stdout => '{"version":"7.12.1"}', :exit_code => 0)
-        expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/}, anything).once.ordered.and_return(ssl_result)
-        expect(subject).to receive(:on).with(anything, %r{http://localhost:8080/}, anything).once.ordered.and_return(nonssl_result)
+        nonssl_result = double(Beaker::Result, :stdout => '{"puppetdb-status":{"state":"running"}}', :exit_code => 0)
+        expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/status/v1/services/puppetdb-status}, anything).once.ordered.and_return(ssl_result)
+        expect(subject).to receive(:on).with(anything, %r{http://localhost:8080/status/v1/services/puppetdb-status}, anything).once.ordered.and_return(nonssl_result)
 
         expect { subject.check_puppetdb_status_endpoint(unixhost) }.not_to raise_error
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: beaker-pe
 version: !ruby/object:Gem::Version
-  version: 3.6.6
+  version: 3.6.7
 platform: ruby
 authors:
 - Puppetlabs