beaker-puppet 4.4.2 → 4.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c7e6d038ac57aef64b353df0164ffc60deaa271b12ac273484e9b3af2ef15008
-  data.tar.gz: 4b79a68287b4b82c9fa322c8020e31c54cac11d5aee4dbd37c470eb0bd655a6c
+  metadata.gz: e9d1aa526da4c8769497a59aabdbbe0ac613257a1821007382990de7c33c3894
+  data.tar.gz: 8a39103726db46e5321e805fda7925197a2011c96f027dbd4cc9b936abcafc40
 SHA512:
-  metadata.gz: 63f4933b686b1d43dc520575b752f4f4267e97a3b8646debc04707a6efd04405d366aa6da5d5fbee2ad1eafc97dcb669e8e0fae3121448c149f253f0491ccbed
-  data.tar.gz: 339bcc300c9ee16b5157cceb6fa933d95f57062738a5153dec963a64a91d7b39b42d502d86046d00e2e6c48bcf4d7db9c6682ab69abfe7941fa3bc060fcc8f27
+  metadata.gz: d71514b42d3f9aca125c68a7458a36c047a5a2a1214b5645acd0faba6274b3f30cc4e98de95526ce291318680a498491d977f8f150812a19a9f5f1c875b9d2db
+  data.tar.gz: 61fd33d1feff22ddbce4580e3865dc187d381eb125c8698e6b455f5abbc3ab46fe785152a94c49f2d71a5e7ca822fa6874290f3b31138e87fdbabd708be39093

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [4.4.3](https://github.com/puppetlabs/beaker-puppet/tree/4.4.3) (2026-08-17)
+
+[Full Changelog](https://github.com/puppetlabs/beaker-puppet/compare/4.4.2...4.4.3)
+
+**Merged pull requests:**
+
+- \(PE-45697\) Content-validate PuppetDB readiness over the ssl status port [\#280](https://github.com/puppetlabs/beaker-puppet/pull/280) ([steveax](https://github.com/steveax))
+
 ## [4.4.2](https://github.com/puppetlabs/beaker-puppet/tree/4.4.2) (2026-08-12)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-puppet/compare/4.4.1...4.4.2)

data/lib/beaker-puppet/helpers/puppet_helpers.rb

@@ -662,37 +662,49 @@ module Beaker
             endpoint = 'status/v1/services/puppetdb-status'
             expected_regex = '\"state\" \{0,\}: \{0,\}\"running\"'
           end
-          # The ssl status port is always enabled and is the check this method
-          # ultimately reports the result of, so use it as the primary
-          # liveness gate. Checking the nonssl port FIRST (as this method used
-          # to) meant every host with it disabled -- the default for fresh
-          # installs as of PE-45384/PE-44906 (SECVULN-1792) -- burned through
-          # 120 failed retries (~2 minutes, at retry_on's default 1s
-          # retry_interval) before ever reaching the check that actually
-          # matters (PE-45697).
-          result = curl_with_retries('start puppetdb (ssl)',
-                                     host, "https://#{host.node_name}:#{ssl_port}", [35, 60])
-
-          # Now that ssl liveness is already confirmed, the nonssl check is
-          # just a quick, best-effort secondary confirmation: a small retry
-          # budget is enough, and its absence -- by design, on a host with
-          # the cleartext listener disabled -- shouldn't fail this method.
-          nonssl_status_command = "curl -m 1 http://localhost:#{nonssl_port}/#{endpoint} | grep '#{expected_regex}'"
+          # Confirm readiness -- not just liveness -- over the ssl status port,
+          # which is always enabled. /status/v1/* (and the pre-4.0 /pdb/meta
+          # fallback) is allow-unauthenticated and PuppetDB's jetty listener is
+          # client-auth=want, so `curl -k` gets a real, content-validated body
+          # with no client cert, and it works even when the cleartext listener
+          # is disabled by default (PE-45384/PE-44906, SECVULN-1792).
+          #
+          # PE-45697 could no longer perform this running-state validation once
+          # it had to stop relying on the (now disabled-by-default) cleartext
+          # port: it fell back to a bare curl_with_retries liveness probe, which
+          # only confirms the tls port answers, not that puppetdb reports a
+          # running state -- reopening the "port up but not ready" race the
+          # nonssl content check used to guard. Restore that check over ssl.
+          ssl_status_command = "curl -m 1 -k https://localhost:#{ssl_port}/#{endpoint} | grep '#{expected_regex}'"
           begin
-            retry_on(host, nonssl_status_command, { max_retries: 5 })
+            result = retry_on(host, ssl_status_command, { max_retries: 60 })
           rescue RuntimeError => e
             # Only treat this as the known "exhausted all retries" failure
-            # retry_on itself raises for THIS command (a plain RuntimeError
-            # with this exact templated message, see beaker's
+            # retry_on itself raises for THIS command (a plain RuntimeError with
+            # this exact templated message, see beaker's
             # Beaker::DSL::Helpers::HostHelpers#retry_on) -- not any other
-            # RuntimeError, or a same-shaped error for a different command,
-            # that might surface from deeper in the retry loop (e.g. an
-            # SSH/connection error from the underlying on() call). Re-raise
-            # anything else unrecognized rather than silently reclassifying
-            # it below (PE-45697).
-            raise unless e.message == "Command `#{nonssl_status_command}` failed."
-
-            logger.warn("sleep_until_puppetdb_started: nonssl status check on port #{nonssl_port} did not succeed (#{e.message}), but ssl status check already confirmed puppetdb is running")
+            # RuntimeError, or a same-shaped error for a different command, that
+            # might surface from deeper in the retry loop (e.g. an SSH/connection
+            # error from the underlying on() call).
+            raise unless e.message == "Command `#{ssl_status_command}` failed."
+
+            # The ssl status endpoint didn't serve unauthenticated content
+            # (older or nonstandard config). Degrade to the previous behaviour
+            # rather than failing: a bare ssl liveness probe, plus a best-effort
+            # nonssl content check whose absence -- by design, on a host with the
+            # cleartext listener disabled -- must not fail this method.
+            logger.warn("sleep_until_puppetdb_started: ssl status content check did not confirm a running state (#{e.message}); falling back to an ssl liveness probe")
+            result = curl_with_retries('start puppetdb (ssl)',
+                                       host, "https://#{host.node_name}:#{ssl_port}", [35, 60])
+
+            nonssl_status_command = "curl -m 1 http://localhost:#{nonssl_port}/#{endpoint} | grep '#{expected_regex}'"
+            begin
+              retry_on(host, nonssl_status_command, { max_retries: 5 })
+            rescue RuntimeError => nonssl_error
+              raise unless nonssl_error.message == "Command `#{nonssl_status_command}` failed."
+
+              logger.warn("sleep_until_puppetdb_started: nonssl status check on port #{nonssl_port} did not succeed (#{nonssl_error.message}), but ssl liveness was confirmed")
+            end
           end
 
           result

data/lib/beaker-puppet/version.rb

@@ -1,3 +1,3 @@
 module BeakerPuppet
-  VERSION = '4.4.2'
+  VERSION = '4.4.3'
 end

data/spec/beaker-puppet/helpers/puppet_helpers_spec.rb

@@ -1034,96 +1034,119 @@ describe ClassMixedWithDSLHelpers do
       allow(subject).to receive(:version_is_less).and_return(true)
     end
 
-    it 'uses the default ports if none given, checking ssl before nonssl' do
+    it 'content-validates over the ssl status port and, on success, never touches the cleartext port' do
       host = hosts[0]
-      expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
-      expect(subject).to receive(:retry_on).with(anything, /8080/, anything).once.ordered
-      subject.sleep_until_puppetdb_started(host)
-    end
-
-    it 'allows setting the nonssl_port' do
-      host = hosts[0]
-      expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
-      expect(subject).to receive(:retry_on).with(anything, /8084/, anything).once.ordered
+      expect(subject).to receive(:retry_on).with(anything, %r{-k https://localhost:8081/}, { max_retries: 60 }).once
+      expect(subject).not_to receive(:curl_with_retries)
+      expect(subject).not_to receive(:retry_on).with(anything, %r{http://localhost:8080/}, anything)
 
-      subject.sleep_until_puppetdb_started(host, 8084)
+      subject.sleep_until_puppetdb_started(host)
     end
 
     it 'allows setting the ssl_port' do
       host = hosts[0]
-      expect(subject).to receive(:curl_with_retries).with(anything, anything, /8085/, anything).once.ordered
-      expect(subject).to receive(:retry_on).with(anything, /8080/, anything).once.ordered
+      expect(subject).to receive(:retry_on).with(anything, %r{-k https://localhost:8085/}, { max_retries: 60 }).once
 
       subject.sleep_until_puppetdb_started(host, nil, 8085)
     end
 
-    context 'when the cleartext status port never responds (e.g. disabled by default)' do
-      it 'swallows the failure once ssl liveness is already confirmed' do
+    context 'when pe_ver is less than 2016.1.0' do
+      it 'content-validates the version endpoint over ssl' do
         host = hosts[0]
-        expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
-        expect(subject).to receive(:retry_on).with(anything, anything, { max_retries: 5 }).once.ordered do |_host, command, _opts|
-          raise "Command `#{command}` failed."
-        end
+        host['pe_ver'] = '2015.3.3'
+        expect(subject).to receive(:version_is_less).with(host['pe_ver'], '2016.1.0').and_return(true)
+        expect(subject).to receive(:retry_on).with(anything, %r{-k https://localhost:8081/pdb/meta/v1/version},
+                                                   { max_retries: 60 }).once
 
-        expect { subject.sleep_until_puppetdb_started(host) }.not_to raise_error
+        subject.sleep_until_puppetdb_started(host)
       end
     end
 
-    context 'when the ssl check itself fails' do
-      it 'raises without ever attempting the nonssl check' do
+    context 'when pe_ver is greater than 2015.9.9' do
+      it 'content-validates the status endpoint over ssl' do
         host = hosts[0]
-        expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once
-                                                      .and_raise('Command `curl -m 1 https://.../` failed.')
-        expect(subject).not_to receive(:retry_on)
+        host['pe_ver'] = '2016.1.0'
+        expect(subject).to receive(:version_is_less).with(host['pe_ver'], '2016.1.0').and_return(false)
+        expect(subject).to receive(:retry_on).with(anything, %r{-k https://localhost:8081/status/v1/services/puppetdb-status},
+                                                   { max_retries: 60 }).once
 
-        expect { subject.sleep_until_puppetdb_started(host) }.to raise_error(/https/)
+        subject.sleep_until_puppetdb_started(host)
       end
     end
 
-    context 'when retry_on raises a RuntimeError unrelated to exhausted retries' do
-      it 'propagates the error rather than treating it as a disabled port' do
+    context 'when the ssl status endpoint does not serve unauthenticated content' do
+      # Older/nonstandard configs: degrade to the previous behaviour rather
+      # than failing -- a bare ssl liveness probe plus a best-effort nonssl
+      # content check.
+      it 'falls back to an ssl liveness probe and a nonssl content check' do
         host = hosts[0]
-        expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
-        expect(subject).to receive(:retry_on).with(anything, /8080/, anything).once.ordered
-                                             .and_raise('Host unreachable: no route to host')
+        expect(subject).to receive(:retry_on).with(anything, %r{-k https://localhost:8081/}, { max_retries: 60 }).once.ordered do |_host, command, _opts|
+          raise "Command `#{command}` failed."
+        end
+        expect(subject).to receive(:curl_with_retries).with(anything, anything, %r{https://[^/]*:8081}, [35, 60]).once.ordered
+        expect(subject).to receive(:retry_on).with(anything, %r{http://localhost:8080/}, { max_retries: 5 }).once.ordered
 
-        expect { subject.sleep_until_puppetdb_started(host) }.to raise_error(/Host unreachable/)
+        expect { subject.sleep_until_puppetdb_started(host) }.not_to raise_error
       end
-    end
 
-    context 'when retry_on raises a RuntimeError formatted like the templated failure but for a different command' do
-      it 'propagates the error rather than treating it as a disabled port' do
+      it 'allows setting the nonssl_port in the fallback path' do
         host = hosts[0]
-        expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
-        expect(subject).to receive(:retry_on).with(anything, /8080/, anything).once.ordered
-                                             .and_raise('Command `some other command` failed.')
+        expect(subject).to receive(:retry_on).with(anything, %r{-k https://localhost:8081/}, { max_retries: 60 }).once.ordered do |_host, command, _opts|
+          raise "Command `#{command}` failed."
+        end
+        expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, [35, 60]).once.ordered
+        expect(subject).to receive(:retry_on).with(anything, %r{http://localhost:8084/}, { max_retries: 5 }).once.ordered
 
-        expect { subject.sleep_until_puppetdb_started(host) }.to raise_error(/some other command/)
+        subject.sleep_until_puppetdb_started(host, 8084)
+      end
+
+      context 'and the cleartext status port never responds (e.g. disabled by default)' do
+        it 'swallows the nonssl failure once ssl liveness is confirmed' do
+          host = hosts[0]
+          expect(subject).to receive(:retry_on).with(anything, %r{-k https://localhost:8081/}, { max_retries: 60 }).once.ordered do |_host, command, _opts|
+            raise "Command `#{command}` failed."
+          end
+          expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, [35, 60]).once.ordered
+          expect(subject).to receive(:retry_on).with(anything, %r{http://localhost:8080/}, { max_retries: 5 }).once.ordered do |_host, command, _opts|
+            raise "Command `#{command}` failed."
+          end
+
+          expect { subject.sleep_until_puppetdb_started(host) }.not_to raise_error
+        end
+
+        it 'propagates an unrelated RuntimeError from the nonssl check' do
+          host = hosts[0]
+          expect(subject).to receive(:retry_on).with(anything, %r{-k https://localhost:8081/}, { max_retries: 60 }).once.ordered do |_host, command, _opts|
+            raise "Command `#{command}` failed."
+          end
+          expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, [35, 60]).once.ordered
+          expect(subject).to receive(:retry_on).with(anything, %r{http://localhost:8080/}, { max_retries: 5 }).once.ordered
+                                               .and_raise('Host unreachable: no route to host')
+
+          expect { subject.sleep_until_puppetdb_started(host) }.to raise_error(/Host unreachable/)
+        end
       end
     end
 
-    context 'when pe_ver is less than 2016.1.0' do
-      it 'uses the version endpoint' do
+    context 'when the ssl content check raises a RuntimeError unrelated to exhausted retries' do
+      it 'propagates the error rather than falling back' do
         host = hosts[0]
-        host['pe_ver'] = '2015.3.3'
-        expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
-        expect(subject).to receive(:retry_on).with(anything, %r{pdb/meta/v1/version}, anything).once.ordered
+        expect(subject).to receive(:retry_on).with(anything, %r{-k https://localhost:8081/}, { max_retries: 60 }).once
+                                             .and_raise('Host unreachable: no route to host')
+        expect(subject).not_to receive(:curl_with_retries)
 
-        expect(subject).to receive(:version_is_less).with(host['pe_ver'], '2016.1.0').and_return(true)
-        subject.sleep_until_puppetdb_started(host)
+        expect { subject.sleep_until_puppetdb_started(host) }.to raise_error(/Host unreachable/)
       end
     end
 
-    context 'when pe_ver is greater than 2015.9.9' do
-      it 'uses the status endpoint' do
+    context 'when the ssl content check raises the templated failure but for a different command' do
+      it 'propagates the error rather than falling back' do
         host = hosts[0]
-        host['pe_ver'] = '2016.1.0'
-        expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
-        expect(subject).to receive(:retry_on).with(anything, %r{status/v1/services/puppetdb-status},
-                                                   anything).once.ordered
+        expect(subject).to receive(:retry_on).with(anything, %r{-k https://localhost:8081/}, { max_retries: 60 }).once
+                                             .and_raise('Command `some other command` failed.')
+        expect(subject).not_to receive(:curl_with_retries)
 
-        expect(subject).to receive(:version_is_less).with(host['pe_ver'], '2016.1.0').and_return(false)
-        subject.sleep_until_puppetdb_started(host)
+        expect { subject.sleep_until_puppetdb_started(host) }.to raise_error(/some other command/)
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: beaker-puppet
 version: !ruby/object:Gem::Version
-  version: 4.4.2
+  version: 4.4.3
 platform: ruby
 authors:
 - Vox Pupuli
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-12 00:00:00.000000000 Z
+date: 2026-08-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fakefs