puppet 3.8.7 → 4.0.0.rc1

data/lib/puppet/data_providers/data_adapter.rb

@@ -0,0 +1,86 @@
+# A DataAdapter adapts an object with a Hash of data
+#
+class Puppet::DataProviders::DataAdapter < Puppet::Pops::Adaptable::Adapter
+  attr_accessor :data
+  attr_accessor :env_provider
+
+  def initialize(env)
+    @env = env
+    @data = {}
+  end
+
+  def [](name)
+    @data[name]
+  end
+
+  def has_name?(name)
+    @data.has_key? name
+  end
+
+  def []=(name, value)
+    unless value.is_a?(Hash)
+      raise ArgumentError, "Given value must be a Hash, got: #{value.class}."
+    end
+    @data[name] = value
+  end
+
+  def env_provider
+    @env_provider ||= initialize_env_provider
+  end
+
+  def module_provider(module_name)
+    @data[module_name] ||= initialize_module_provider(module_name)
+  end
+
+  def self.create_adapter(environment)
+    new(environment)
+  end
+
+  def initialize_module_provider(module_name)
+    # Support running tests without an injector being configured == using a null implementation
+    unless injector = Puppet.lookup(:injector) { nil }
+      return Puppet::Plugins::DataProviders::ModuleDataProvider.new()
+    end
+    # Get the registry of module to provider implementation name
+    module_service_type = Puppet::Plugins::DataProviders.hash_of_per_module_data_provider
+    module_service_name = Puppet::Plugins::DataProviders::PER_MODULE_DATA_PROVIDER_KEY
+    module_service = Puppet.lookup(:injector).lookup(nil, module_service_type, module_service_name)
+    provider_name = module_service[module_name] || 'none'
+
+    service_type = Puppet::Plugins::DataProviders.hash_of_module_data_providers
+    service_name = Puppet::Plugins::DataProviders::MODULE_DATA_PROVIDERS_KEY
+
+    # Get the service (registry of known implementations)
+    service = Puppet.lookup(:injector).lookup(nil, service_type, service_name)
+    provider = service[provider_name]
+    unless provider
+      raise Puppet::Error.new("Environment '#{@env.name}', cannot find module_data_provider '#{provider_name}'")
+    end
+    provider
+  end
+
+  def initialize_env_provider
+    # Get the environment's configuration since we need to know which data provider
+    # should be used (includes 'none' which gets a null implementation).
+    #
+    env_conf = Puppet.lookup(:environments).get_conf(@env.name)
+
+    # Get the data provider and find the bound implementation
+    # TODO: PUP-1640, drop the nil check when legacy env support is dropped
+    provider_name = env_conf.nil? ? 'none' : env_conf.environment_data_provider
+    service_type = Puppet::Plugins::DataProviders.hash_of_environment_data_providers
+    service_name = Puppet::Plugins::DataProviders::ENV_DATA_PROVIDERS_KEY
+
+    # Get the service (registry of known implementations)
+    # Support running tests without an injector being configured == using a null implementation
+    unless injector = Puppet.lookup(:injector) { nil }
+      return Puppet::Plugins::DataProviders::EnvironmentDataProvider.new()
+    end
+    service = Puppet.lookup(:injector).lookup(nil, service_type, service_name)
+    provider = service[provider_name]
+    unless provider
+      raise Puppet::Error.new("Environment '#{@env.name}', cannot find environment_data_provider '#{provider_name}'")
+    end
+    provider
+  end
+end

data/lib/puppet/data_providers/data_function_support.rb

@@ -0,0 +1,32 @@
+module Puppet::DataProviders::DataFunctionSupport
+  # Gets the data from the compiler, or initializes it from a function call if not present in the compiler.
+  # This means, that the function providing the data is called once per compilation, and the data is cached for
+  # as long as the compiler lives (which is for one catalog production).
+  # This makes it possible to return data that is tailored for the request.
+  # The class including this module must implement `loader(scope)` to return the apropriate loader.
+  #
+  def data(key, scope)
+    compiler = scope.compiler
+    adapter = Puppet::DataProviders::DataAdapter.get(compiler) || Puppet::DataProviders::DataAdapter.adapt(compiler)
+    adapter.data[key] ||= initialize_data_from_function("#{key}::data", scope)
+  end
+
+  def initialize_data_from_function(name, scope)
+    Puppet::Util::Profiler.profile("Called #{name}", [ :functions, name ]) do
+      loader = loader(scope)
+      if loader && func = loader.load(:function, name)
+        # function found, call without arguments, must return a Hash
+        # TODO: Validate the function - to ensure it does not contain unwanted side effects
+        #       That can only be done if the function is a puppet function
+        #
+        result = func.call(scope)
+        unless result.is_a?(Hash)
+          raise Puppet::Error.new("Expected '#{name}' function to return a Hash, got #{result.class}")
+        end
+      else
+        raise Puppet::Error.new("Data from 'function' cannot find the required '#{name}' function")
+      end
+      result
+    end
+  end
+end

data/lib/puppet/data_providers/function_env_data_provider.rb

@@ -0,0 +1,28 @@
+# This file is loaded by the autoloader, and it does not find the data function support unless required relative
+#
+require_relative 'data_function_support'
+module Puppet::DataProviders; end
+
+# The FunctionEnvDataProvider provides data from a function called 'environment::data()' that resides in a
+# directory environment (seen as a module with the name environment).
+# The function is called on demand, and is associated with the compiler via an Adapter. This ensures that the data
+# is only produced once per compilation.
+#
+class Puppet::DataProviders::FunctionEnvDataProvider < Puppet::Plugins::DataProviders::EnvironmentDataProvider
+  include Puppet::DataProviders::DataFunctionSupport
+
+  def lookup(name, scope, merge)
+    begin
+      hash = data('environment', scope)
+      throw :no_such_key unless hash.include?(name)
+      hash[name]
+    rescue *Puppet::Error => detail
+      raise Puppet::DataBinding::LookupError.new(detail.message, detail)
+    end
+  end
+
+  def loader(scope)
+    # This loader allows the data function to be private or public in the environment
+    scope.compiler.loaders.private_environment_loader
+  end
+end

data/lib/puppet/data_providers/function_module_data_provider.rb

@@ -0,0 +1,44 @@
+# This file is loaded by the autoloader, and it does not find the data function support unless required relative
+#
+require_relative 'data_function_support'
+module Puppet::DataProviders; end
+
+# The FunctionModuleDataProvider provides data from a function called 'environment::data()' that resides in a
+# directory environment (seen as a module with the name environment).
+# The function is called on demand, and is associated with the compiler via an Adapter. This ensures that the data
+# is only produced once per compilation.
+#
+class Puppet::DataProviders::FunctionModuleDataProvider < Puppet::Plugins::DataProviders::ModuleDataProvider
+  MODULE_NAME = 'module_name'.freeze
+  include Puppet::DataProviders::DataFunctionSupport
+
+  def lookup(name, scope, merge)
+    # If the module name does not exist, this call is not from within a module, and should be ignored.
+    unless scope.exist?(MODULE_NAME)
+      return nil
+    end
+    # Get the module name. Calls to the lookup method should only be performed for modules that have opted in
+    # by specifying that they use the 'function' implementation as the module_data provider. Thus, this will error
+    # out if a module specified 'function' but did not provide a function called <module-name>::data
+    #
+    module_name = scope[MODULE_NAME]
+    begin
+      hash = data(module_name, scope)
+      throw :no_such_key unless hash.include?(name)
+      hash[name]
+    rescue *Puppet::Error => detail
+      raise Puppet::DataBinding::LookupError.new(detail.message, detail)
+    end
+  end
+
+  def loader(scope)
+    loaders = scope.compiler.loaders
+    if scope.exist?(MODULE_NAME)
+      loaders.private_loader_for_module(scope[MODULE_NAME])
+    else
+      # Produce the environment's loader when not in a module
+      # This loader allows the data function to be private or public in the environment
+      loaders.private_environment_loader
+    end
+  end
+end

data/lib/puppet/defaults.rb

@@ -14,7 +14,6 @@ module Puppet
   ############################################################################################
 
   AS_DURATION = %q{This setting can be a time interval in seconds (30 or 30s), minutes (30m), hours (6h), days (2d), or years (5y).}
-  STORECONFIGS_ONLY = %q{This setting is only used by the ActiveRecord storeconfigs and inventory backends, which are deprecated.}
 
   # This is defined first so that the facter implementation is replaced before other setting defaults are evaluated.
   define_settings(:main,
@@ -27,6 +26,9 @@ module Puppet
           raise ArgumentError, 'facter has already evaluated facts.' if Facter.instance_variable_get(:@collection)
           raise ArgumentError, 'cfacter version 0.2.0 or later is not installed.' unless Puppet.features.cfacter?
           CFacter.initialize
+
+          # Setup Facter's logging again now that native facter is initialized
+          Puppet::Util::Logging.setup_facter_logging!
         end
     }
   )
@@ -41,6 +43,15 @@ module Puppet
           directory, but if it's running as any other user, it defaults to being
           in the user's home directory.",
     },
+    :codedir  => {
+        :default  => nil,
+        :type     => :directory,
+        :desc     => "The main Puppet code directory.  The default for this setting
+          is calculated based on the user.  If the process is running as root or
+          the user that Puppet is supposed to run as, it defaults to a system
+          directory, but if it's running as any other user, it defaults to being
+          in the user's home directory.",
+    },
     :vardir   => {
         :default  => nil,
         :type     => :directory,
@@ -83,6 +94,8 @@ module Puppet
         * emerg
         * crit
         ",
+      :hook => proc {|value| Puppet::Util::Log.level = value },
+      :call_hook => :on_initialize_and_write,
     },
     :disable_warnings => {
       :default => [],
@@ -122,6 +135,10 @@ module Puppet
         :default  => false,
         :type     => :boolean,
         :desc     => "Whether to print stack traces on some errors",
+        :hook     => proc do |value|
+          # Enable or disable Facter's trace option too
+          Facter.trace(value) if Facter.respond_to? :trace
+        end
     },
     :profile => {
         :default  => false,
@@ -208,7 +225,10 @@ module Puppet
     :path => {
         :default          => "none",
         :desc             => "The shell search path.  Defaults to whatever is inherited
-          from the parent process.",
+          from the parent process.
+
+          This setting can only be set in the `[main]` section of puppet.conf; it cannot
+          be set in `[master]`, `[agent]`, or an environment config section.",
         :call_hook => :on_define_and_write,
         :hook             => proc do |value|
           ENV["PATH"] = "" if ENV["PATH"].nil?
@@ -230,18 +250,11 @@ module Puppet
           is in Ruby's search path\n",
       :call_hook => :on_initialize_and_write,
       :hook             => proc do |value|
-        $LOAD_PATH.delete(@oldlibdir) if defined?(@oldlibdir) and $LOAD_PATH.include?(@oldlibdir)
+        $LOAD_PATH.delete(@oldlibdir) if defined?(@oldlibdir) && $LOAD_PATH.include?(@oldlibdir)
         @oldlibdir = value
         $LOAD_PATH << value
       end
     },
-    :ignoreimport => {
-        :default  => false,
-        :type     => :boolean,
-        :desc     => "If true, allows the parser to continue without requiring
-          all files referenced with `import` statements to exist. This setting was primarily
-          designed for use with commit hooks for parse-checking.",
-    },
     :environment => {
         :default  => "production",
         :desc     => "The environment Puppet is running in.  For clients
@@ -250,13 +263,13 @@ module Puppet
           this provides the default environment for nodes we know nothing about."
     },
     :environmentpath => {
-      :default => "",
+      :default => "$codedir/environments",
       :desc    => "A search path for directory environments, as a list of directories
         separated by the system path separator character. (The POSIX path separator
         is ':', and the Windows path separator is ';'.)
 
         This setting must have a value set to enable **directory environments.** The
-        recommended value is `$confdir/environments`. For more details, see
+        recommended value is `$codedir/environments`. For more details, see
         http://docs.puppetlabs.com/puppet/latest/reference/environments.html",
       :type    => :path,
     },
@@ -343,17 +356,10 @@ module Puppet
       :desc    => "Where to retrive information about data.",
     },
     :hiera_config => {
-      :default => "$confdir/hiera.yaml",
+      :default => "$codedir/hiera.yaml",
       :desc    => "The hiera configuration file. Puppet only reads this file on startup, so you must restart the puppet master every time you edit it.",
       :type    => :file,
     },
-    :binder => {
-      :default => false,
-      :desc    => "Turns the binding system on or off. This includes bindings in modules.
-        The binding system aggregates data from modules and other locations and makes them available for lookup.
-        The binding system is experimental and any or all of it may change.",
-      :type    => :boolean,
-    },
     :binder_config => {
       :default => nil,
       :desc    => "The binder configuration file. Puppet reads this file on each request to configure the bindings system.
@@ -375,20 +381,6 @@ module Puppet
     :facts_terminus => {
       :default => 'facter',
       :desc => "The node facts terminus.",
-      :call_hook => :on_initialize_and_write,
-      :hook => proc do |value|
-        require 'puppet/node/facts'
-        # Cache to YAML if we're uploading facts away
-        if %w[rest inventory_service].include? value.to_s
-          Puppet.info "configuring the YAML fact cache because a remote terminus is active"
-          Puppet::Node::Facts.indirection.cache_class = :yaml
-        end
-      end
-    },
-    :inventory_terminus => {
-      :type       => :terminus,
-      :default    => "$facts_terminus",
-      :desc       => "Should usually be the same as the facts terminus",
     },
     :default_file_terminus => {
       :type       => :terminus,
@@ -398,13 +390,6 @@ module Puppet
       retrieved using the `server` setting. When running `apply` the default
       is `file_server`, causing requests to be filled locally."
     },
-    :httplog => {
-        :default  => "$logdir/http.log",
-        :type     => :file,
-        :owner    => "root",
-        :mode     => "0640",
-        :desc     => "Where the puppet agent web server logs.",
-    },
     :http_proxy_host => {
       :default    => "none",
       :desc       => "The HTTP proxy host to use for outgoing connections.  Note: You
@@ -444,6 +429,19 @@ module Puppet
       :type       => :boolean,
       :desc       => "Whether to write HTTP request and responses to stderr. This should never be used in a production environment."
     },
+    :http_connect_timeout => {
+      :default => "2m",
+      :type    => :duration,
+      :desc    => "The maximum amount of time to wait when establishing an HTTP connection. The default
+      value is 2 minutes.
+      #{AS_DURATION}",
+    },
+    :http_read_timeout => {
+      :type    => :duration,
+      :desc    => "The time to wait for one block to be read from an HTTP connection. If nothing is
+      read after the elapsed interval then the connection will be closed. The default value is unlimited.
+      #{AS_DURATION}",
+    },
     :filetimeout => {
       :default    => "15s",
       :type       => :duration,
@@ -454,89 +452,18 @@ module Puppet
     :environment_timeout => {
       :default    => "0",
       :type       => :ttl,
-      :desc       => "How long the Puppet master should cache data it loads from an
-      environment.
+      :desc       => "The time to live for a cached environment.
       #{AS_DURATION}
-      A value of `0` will disable caching. This setting can also be set to
-      `unlimited`, which will cache environments until the master is restarted
-      or told to refresh the cache.
-
-      You should change this setting once your Puppet deployment is doing
-      non-trivial work. We chose the default value of `0` because it lets new
-      users update their code without any extra steps, but it lowers the
-      performance of your Puppet master.
-
-      We recommend setting this to `unlimited` and explicitly refreshing your
-      Puppet master as part of your code deployment process.
-
-      * With Puppet Server, you should refresh environments by calling the
-        `environment-cache` API endpoint. See the docs for the Puppet Server
-        administrative API.
-      * With a Rack Puppet master, you should restart the web server or the
-        application server. Passenger lets you touch a `restart.txt` file to
-        refresh an application without restarting Apache; see the Passenger docs
-        for details.
-
-      We don't recommend using any value other than `0` or `unlimited`, since
-      most Puppet masters use a pool of Ruby interpreters which all have their
-      own cache timers. When these timers drift out of sync, agents can be served
-      inconsistent catalogs."
-    },
-    :queue_type => {
-      :default    => "stomp",
-      :desc       => "Which type of queue to use for asynchronous processing.",
-    },
-    :queue_source => {
-      :default    => "stomp://localhost:61613/",
-      :desc       => "Which type of queue to use for asynchronous processing.  If your stomp server requires
-      authentication, you can include it in the URI as long as your stomp client library is at least 1.1.1",
-    },
-    :async_storeconfigs => {
-        :default  => false,
-        :type     => :boolean,
-        :desc     => "Whether to use a queueing system to provide asynchronous database integration.
-      Requires that `puppet queue` be running.",
-        :hook     => proc do |value|
-          if value
-            # This reconfigures the termini for Node, Facts, and Catalog
-            Puppet.settings.override_default(:storeconfigs, true)
-
-            # But then we modify the configuration
-            Puppet::Resource::Catalog.indirection.cache_class = :queue
-            Puppet.settings.override_default(:catalog_cache_terminus, :queue)
-          else
-            raise "Cannot disable asynchronous storeconfigs in a running process"
-          end
-        end
-    },
-    :thin_storeconfigs => {
-      :default  => false,
-      :type     => :boolean,
-      :desc     =>
-    "Boolean; whether Puppet should store only facts and exported resources in the storeconfigs
-    database. This will improve the performance of exported resources with the older
-    `active_record` backend, but will disable external tools that search the storeconfigs database.
-    Thinning catalogs is generally unnecessary when using PuppetDB to store catalogs.",
-      :hook     => proc do |value|
-        Puppet.settings.override_default(:storeconfigs, true) if value
-        end
-      },
-    :config_version => {
-      :default    => "",
-      :desc       => "How to determine the configuration version.  By default, it will be the
-      time that the configuration is parsed, but you can provide a shell script to override how the
-      version is determined.  The output of this script will be added to every log message in the
-      reports, allowing you to correlate changes on your hosts to the source version on the server.
-
-      Setting a global value for config_version in puppet.conf is deprecated. Please set a
-      per-environment value in environment.conf instead. For more info, see
-      http://docs.puppetlabs.com/puppet/latest/reference/environments.html",
-      :deprecated => :allowed_on_commandline,
+      This setting can also be set to `unlimited`, which causes the environment to
+      be cached until the master is restarted."
     },
-    :zlib => {
-        :default  => true,
-        :type     => :boolean,
-        :desc     => "Boolean; whether to use the zlib library",
+    :environment_data_provider => {
+      :default    => "none",
+      :desc       => "The name of a registered environment data provider. The two built in
+      and registered providers are 'none' (no environment specific data), and 'function'
+      (environment specific data obtained by calling the function 'environment::data()').
+      Other environment data providers may be registered in modules on the module path. For such
+      custom data providers see the respective module documentation."
     },
     :prerun_command => {
       :default    => "",
@@ -555,31 +482,6 @@ module Puppet
         :desc     => "Freezes the 'main' class, disallowing any code to be added to it.  This
           essentially means that you can't have any code outside of a node,
           class, or definition other than in the site manifest.",
-    },
-    :stringify_facts => {
-      :default => true,
-      :type    => :boolean,
-      :desc    => "Flatten fact values to strings using #to_s. Means you can't have arrays or
-        hashes as fact values. (DEPRECATED) This option will be removed in Puppet 4.0.",
-    },
-    :trusted_node_data => {
-      :default => false,
-      :type    => :boolean,
-      :desc    => "Stores trusted node data in a hash called $trusted.
-        When true also prevents $trusted from being overridden in any scope.",
-    },
-    :immutable_node_data => {
-      :default => '$trusted_node_data',
-      :type    => :boolean,
-      :desc    => "When true, also prevents $trusted and $facts from being overridden in any scope",
-    },
-    :preview_outputdir => {
-      :default => '$vardir/preview',
-      :type     => :directory,
-      :mode     => "0750",
-      :owner    => "service",
-      :group    => "service",
-      :desc    => "The directory where catalog previews per node are generated."
     }
   )
   Puppet.define_settings(:module_tool,
@@ -588,7 +490,7 @@ module Puppet
       :desc     => "The module repository",
     },
     :module_working_dir => {
-        :default  => (Puppet.features.microsoft_windows? ? Dir.tmpdir() : '$vardir/puppet-module'),
+        :default  => '$vardir/puppet-module',
         :desc     => "The directory into which module tool data is stored",
     },
     :module_skeleton_dir => {
@@ -636,37 +538,6 @@ module Puppet
 
         Defaults to the node's fully qualified domain name.",
       :hook => proc { |value| raise(ArgumentError, "Certificate names must be lower case; see #1168") unless value == value.downcase }},
-    :certdnsnames => {
-      :default => '',
-      :hook    => proc do |value|
-        unless value.nil? or value == '' then
-          Puppet.warning <<WARN
-The `certdnsnames` setting is no longer functional,
-after CVE-2011-3872. We ignore the value completely.
-
-For your own certificate request you can set `dns_alt_names` in the
-configuration and it will apply locally.  There is no configuration option to
-set DNS alt names, or any other `subjectAltName` value, for another nodes
-certificate.
-
-Alternately you can use the `--dns_alt_names` command line option to set the
-labels added while generating your own CSR.
-WARN
-        end
-      end,
-      :desc    => <<EOT
-The `certdnsnames` setting is no longer functional,
-after CVE-2011-3872. We ignore the value completely.
-
-For your own certificate request you can set `dns_alt_names` in the
-configuration and it will apply locally.  There is no configuration option to
-set DNS alt names, or any other `subjectAltName` value, for another nodes
-certificate.
-
-Alternately you can use the `--dns_alt_names` command line option to set the
-labels added while generating your own CSR.
-EOT
-    },
     :dns_alt_names => {
       :default => '',
       :desc    => <<EOT,
@@ -851,12 +722,6 @@ EOT
           Certificate Revocation List (CRL)
           to all clients.  If enabled, CA chaining will almost definitely not work.",
     },
-    :certificate_expire_warning => {
-      :default  => "60d",
-      :type     => :duration,
-      :desc     => "The window of time leading up to a certificate's expiration that a notification
-        will be logged. This applies to CA, master, and agent certificates. #{AS_DURATION}"
-    },
     :digest_algorithm => {
         :default  => 'md5',
         :type     => :enum,
@@ -1038,36 +903,57 @@ EOT
       }
   )
 
-  define_settings(:master,
-    :user => {
-      :default    => "puppet",
-      :desc       => "The user puppet master should run as.",
-    },
-    :group => {
-      :default    => "puppet",
-      :desc       => "The group puppet master should run as.",
-    },
-    :manifestdir => {
-      :default    => "$confdir/manifests",
-      :type       => :directory,
-      :desc       => "Used to build the default value of the `manifest` setting. Has no other purpose.
-
-        This setting is deprecated.",
-      :deprecated => :completely,
-    },
+  define_settings(:environment,
     :manifest => {
-      :default    => "$manifestdir/site.pp",
+      :default    => nil,
       :type       => :file_or_directory,
       :desc       => "The entry-point manifest for puppet master. This can be one file
         or a directory of manifests to be evaluated in alphabetical order. Puppet manages
         this path as a directory if one exists or if the path ends with a / or \\.
 
-        Setting a global value for `manifest` in puppet.conf is deprecated. Please use
+        Setting a global value for `manifest` in puppet.conf is not allowed
+        (but it can be overridden from them commandline). Please use
         directory environments instead. If you need to use something other than the
         environment's `manifests` directory as the main manifest, you can set
         `manifest` in environment.conf. For more info, see
         http://docs.puppetlabs.com/puppet/latest/reference/environments.html",
-      :deprecated => :allowed_on_commandline,
+    },
+    :modulepath => {
+      :default => "",
+      :type => :path,
+      :desc => "The search path for modules, as a list of directories separated by the system
+        path separator character. (The POSIX path separator is ':', and the
+        Windows path separator is ';'.)
+
+        Setting a global value for `modulepath` in puppet.conf is not allowed
+        (but it can be overridden from the commandline). Please use
+        directory environments instead. If you need to use something other than the
+        default modulepath of `<ACTIVE ENVIRONMENT'S MODULES DIR>:$basemodulepath`,
+        you can set `modulepath` in environment.conf. For more info, see
+        http://docs.puppetlabs.com/puppet/latest/reference/environments.html",
+    },
+    :config_version => {
+      :default    => "",
+      :desc       => "How to determine the configuration version.  By default, it will be the
+      time that the configuration is parsed, but you can provide a shell script to override how the
+      version is determined.  The output of this script will be added to every log message in the
+      reports, allowing you to correlate changes on your hosts to the source version on the server.
+
+      Setting a global value for config_version in puppet.conf is not allowed
+      (but it can be overridden from the commandline). Please set a
+      per-environment value in environment.conf instead. For more info, see
+      http://docs.puppetlabs.com/puppet/latest/reference/environments.html",
+    }
+  )
+
+  define_settings(:master,
+    :user => {
+      :default    => "puppet",
+      :desc       => "The user puppet master should run as.",
+    },
+    :group => {
+      :default    => "puppet",
+      :desc       => "The group puppet master should run as.",
     },
     :default_manifest => {
       :default    => "./manifests",
@@ -1106,19 +992,6 @@ EOT
       by `puppet`, and should only be set if you're writing your own Puppet
       executable.",
     },
-    :masterlog => {
-      :default => "$logdir/puppetmaster.log",
-      :type => :file,
-      :owner => "service",
-      :group => "service",
-      :mode => "0660",
-      :desc => "This file is literally never used, although Puppet may create it
-        as an empty file. For more context, see the `puppetdlog` setting and
-        puppet master's `--logdest` command line option.
-
-        This setting is deprecated and will be removed in a future version of Puppet.",
-      :deprecated => :completely
-    },
     :masterhttplog => {
       :default => "$logdir/masterhttp.log",
       :type => :file,
@@ -1137,6 +1010,15 @@ EOT
       this is the port to listen on; for puppet agent, this is the port
       to make requests on. Both applications use this setting to get the port.",
     },
+    :master_url_prefix => {
+        :default => "/puppet",
+        :desc    => "The prefix at which the puppet master API is mounted.",
+        :hook    => proc do |value|
+          if !value.start_with?("/")
+            Puppet[:master_url_prefix] = "/#{value}"
+          end
+        end
+    },
     :node_name => {
       :default    => "cert",
       :desc       => "How the puppet master determines the client's identity
@@ -1166,34 +1048,22 @@ EOT
       :type       => :boolean,
       :desc       => "Whether the master should function as a certificate authority.",
     },
+    :trusted_oid_mapping_file => {
+      :default    => "$confdir/custom_trusted_oid_mapping.yaml",
+      :type       => :file,
+      :desc       => "File that provides mapping between custom SSL oids and user-friendly names"
+    },
     :basemodulepath => {
-      :default => "$confdir/modules#{File::PATH_SEPARATOR}/usr/share/puppet/modules",
+      :default => "$codedir/modules#{File::PATH_SEPARATOR}/opt/puppetlabs/puppet/modules",
       :type => :path,
       :desc => "The search path for **global** modules. Should be specified as a
         list of directories separated by the system path separator character. (The
         POSIX path separator is ':', and the Windows path separator is ';'.)
 
-        If you are using directory environments, these are the modules that will
-        be used by _all_ environments. Note that the `modules` directory of the active
-        environment will have priority over any global directories. For more info, see
-        http://docs.puppetlabs.com/puppet/latest/reference/environments.html
-
-        This setting also provides the default value for the deprecated `modulepath`
-        setting, which is used when directory environments are disabled.",
-    },
-    :modulepath => {
-      :default => "$basemodulepath",
-      :type => :path,
-      :desc => "The search path for modules, as a list of directories separated by the system
-        path separator character. (The POSIX path separator is ':', and the
-        Windows path separator is ';'.)
-
-        Setting a global value for `modulepath` in puppet.conf is deprecated. Please use
-        directory environments instead. If you need to use something other than the
-        default modulepath of `<ACTIVE ENVIRONMENT'S MODULES DIR>:$basemodulepath`,
-        you can set `modulepath` in environment.conf. For more info, see
+        These are the modules that will be used by _all_ environments. Note that
+        the `modules` directory of the active environment will have priority over
+        any global directories. For more info, see
         http://docs.puppetlabs.com/puppet/latest/reference/environments.html",
-      :deprecated => :allowed_on_commandline,
     },
     :ssl_client_header => {
       :default    => "HTTP_X_CLIENT_DN",
@@ -1240,7 +1110,7 @@ EOT
       :default    => "store",
       :desc       => "The list of report handlers to use. When using multiple report handlers,
         their names should be comma-separated, with whitespace allowed. (For example,
-        `reports = http, tagmail`.)
+        `reports = http, store`.)
 
         This setting is relevant to puppet master and puppet apply. The puppet
         master will call these report handlers with the reports it receives from
@@ -1281,25 +1151,6 @@ EOT
     }
   )
 
-  define_settings(:metrics,
-    :rrddir => {
-      :type     => :directory,
-      :default  => "$vardir/rrd",
-      :mode     => "0750",
-      :owner    => "service",
-      :group    => "service",
-      :desc     => "The directory where RRD database files are stored.
-        Directories for each reporting host will be created under
-        this directory."
-    },
-    :rrdinterval => {
-      :default  => "$runinterval",
-      :type     => :duration,
-      :desc     => "How often RRD should expect data.
-            This should match how often the hosts report back to the server. #{AS_DURATION}",
-    }
-  )
-
   define_settings(:device,
     :devicedir =>  {
         :default  => "$vardir/devices",
@@ -1335,13 +1186,6 @@ EOT
         end
       end
     },
-    :localconfig => {
-      :default => "$statedir/localconfig",
-      :type => :file,
-      :owner => "root",
-      :mode => "0660",
-      :desc => "Where puppet agent caches the local configuration.  An
-        extension indicating the cache format is added automatically."},
     :statefile => {
       :default => "$statedir/state.yaml",
       :type => :file,
@@ -1422,10 +1266,6 @@ EOT
       :desc       => "Boolean; whether to generate the default schedule resources. Setting this to
       false is useful for keeping external report processors clean of skipped schedule resources.",
     },
-    :puppetport => {
-      :default    => 8139,
-      :desc       => "Which port puppet agent listens on.",
-    },
     :noop => {
       :default    => false,
       :type       => :boolean,
@@ -1459,15 +1299,6 @@ EOT
           \"never run.\" If you want puppet agent to never run, you should start
           it with the `--no-client` option. #{AS_DURATION}",
     },
-    :listen => {
-      :default    => false,
-      :type       => :boolean,
-      :desc       => "Whether puppet agent should listen for
-      connections.  If this is true, then puppet agent will accept incoming
-      REST API requests, subject to the default ACLs and the ACLs set in
-      the `rest_authconfig` file. Puppet agent can respond usefully to
-      requests on the `run`, `facts`, `certificate`, and `resource` endpoints.",
-    },
     :ca_server => {
       :default    => "$server",
       :desc       => "The server to use for certificate
@@ -1478,18 +1309,6 @@ EOT
       :default    => "$masterport",
       :desc       => "The port to use for the certificate authority.",
     },
-    :catalog_format => {
-      :default => "",
-      :desc => "(Deprecated for 'preferred_serialization_format') What format to
-        use to dump the catalog.  Only supports 'marshal' and 'yaml'.  Only
-        matters on the client, since it asks the server for a specific format.",
-      :hook => proc { |value|
-        if value
-          Puppet.deprecation_warning "Setting 'catalog_format' is deprecated; use 'preferred_serialization_format' instead."
-          Puppet.settings.override_default(:preferred_serialization_format, value)
-        end
-      }
-    },
     :preferred_serialization_format => {
       :default    => "pson",
       :desc       => "The preferred means of serializing
@@ -1498,36 +1317,6 @@ EOT
       can be guaranteed to support this format, but it will be used for all
       classes that support it.",
     },
-    :report_serialization_format => {
-      :default => "pson",
-      :type => :enum,
-      :values => ["pson", "yaml"],
-      :desc => "The serialization format to use when sending reports to the
-      `report_server`. Possible values are `pson` and `yaml`. This setting
-      affects puppet agent, but not puppet apply (which processes its own
-      reports).
-
-      This should almost always be set to `pson`. It can be temporarily set to
-      `yaml` to let agents using this Puppet version connect to a puppet master
-      running Puppet 3.0.0 through 3.2.x.
-
-      Note that this is set to 'yaml' automatically if the agent detects an
-      older master, so should never need to be set explicitly."
-    },
-    :legacy_query_parameter_serialization => {
-        :default    => false,
-        :type       => :boolean,
-        :desc => "The serialization format to use when sending file_metadata
-      query parameters.  Older versions of puppet master expect certain query
-      parameters to be serialized as yaml, which is deprecated.
-
-      This should almost always be false. It can be temporarily set to true
-      to let agents using this Puppet version connect to a puppet master
-      running Puppet 3.0.0 through 3.2.x.
-
-      Note that this is set to true automatically if the agent detects an
-      older master, so should never need to be set explicitly."
-    },
     :agent_catalog_run_lockfile => {
       :default    => "$statedir/agent_catalog_run.lock",
       :type       => :string, # (#2888) Ensure this file is not added to the settings catalog.
@@ -1570,17 +1359,6 @@ EOT
         fact be stale even if the timestamps are up to date - if the facts
         change or if the server changes.",
     },
-    :dynamicfacts => {
-      :default    => "memorysize,memoryfree,swapsize,swapfree",
-      :desc       => "(Deprecated) Facts that are dynamic; these facts will be ignored when deciding whether
-        changed facts should result in a recompile.  Multiple facts should be
-        comma-separated.",
-      :hook => proc { |value|
-        if value
-          Puppet.deprecation_warning "The dynamicfacts setting is deprecated and will be ignored."
-        end
-      }
-    },
     :splaylimit => {
       :default    => "$runinterval",
       :type       => :duration,
@@ -1603,8 +1381,14 @@ EOT
       :default  => "2m",
       :type     => :duration,
       :desc     => "How long the client should wait for the configuration to be retrieved
-        before considering it a failure.  This can help reduce flapping if too
-        many clients contact the server at one time. #{AS_DURATION}",
+        before considering it a failure. This setting is deprecated and has been replaced
+        by http_connect_timeout and http_read_timeout.
+        #{AS_DURATION}",
+      :deprecated => :completely,
+      :hook       => proc do |value|
+        Puppet[:http_connect_timeout] = value
+        Puppet[:http_read_timeout]    = value
+      end
     },
     :report_server => {
       :default  => "$server",
@@ -1614,14 +1398,6 @@ EOT
       :default  => "$masterport",
       :desc     => "The port to communicate with the report_server.",
     },
-    :inventory_server => {
-      :default  => "$server",
-      :desc     => "The server to send facts to.",
-    },
-    :inventory_port => {
-      :default  => "$masterport",
-      :desc     => "The port to communicate with the inventory_server.",
-    },
     :report => {
       :default  => true,
       :type     => :boolean,
@@ -1651,17 +1427,6 @@ EOT
       :type       => :directory,
       :desc       => "Where to store dot-outputted graphs.",
     },
-    :http_compression => {
-      :default    => false,
-      :type       => :boolean,
-      :desc       => "Allow http compression in REST communication with the master.
-        This setting might improve performance for agent -> master
-        communications over slow WANs. Your puppet master needs to support
-        compression (usually by activating some settings in a reverse-proxy in
-        front of the puppet master, which rules out webrick). It is harmless to
-        activate this settings if your master doesn't support compression, but
-        if it supports it, this setting might reduce performance on high-speed LANs.",
-    },
     :waitforcert => {
       :default  => "2m",
       :type     => :duration,
@@ -1682,15 +1447,17 @@ EOT
     :ordering => {
       :type => :enum,
       :values => ["manifest", "title-hash", "random"],
-      :default => "title-hash",
+      :default => "manifest",
       :desc => "How unrelated resources should be ordered when applying a catalog.
       Allowed values are `title-hash`, `manifest`, and `random`. This
       setting affects puppet agent and puppet apply, but not puppet master.
 
-      * `title-hash` (the default) will order resources randomly, but will use
-        the same order across runs and across nodes.
-      * `manifest` will use the order in which the resources were declared in
-        their manifest files.
+      * `manifest` (the default) will use the order in which the resources were
+        declared in their manifest files.
+      * `title-hash` (the default in 3.x) will order resources randomly, but
+        will use the same order across runs and across nodes. It is only of
+        value if you're migrating from 3.x and have errors running with
+        `manifest`.
       * `random` will order resources randomly and change their order with each
         run. This can work like a fuzzer for shaking out undeclared dependencies.
 
@@ -1724,7 +1491,7 @@ EOT
       server.",
     },
     :pluginsource => {
-      :default    => "puppet://$server/plugins",
+      :default    => "puppet:///plugins",
       :desc       => "From where to retrieve plugins.  The standard Puppet `file` type
       is used for retrieval, so anything that is a valid file source can
       be used here.",
@@ -1735,7 +1502,7 @@ EOT
       :desc     => "Where Puppet should store external facts that are being handled by pluginsync",
     },
     :pluginfactsource => {
-      :default  => "puppet://$server/pluginfacts",
+      :default  => "puppet:///pluginfacts",
       :desc     => "Where to retrieve external facts for pluginsync",
     },
     :pluginsync => {
@@ -1769,120 +1536,7 @@ EOT
     }
   )
 
-
-    define_settings(
-    :tagmail,
-    :tagmap => {
-      :default    => "$confdir/tagmail.conf",
-      :desc       => "The mapping between reporting tags and email addresses.",
-    },
-    :sendmail => {
-      :default    => which('sendmail') || '',
-      :desc       => "Where to find the sendmail binary with which to send email.",
-    },
-
-    :reportfrom => {
-        :default  => lambda { "report@#{Puppet::Settings.default_certname.downcase}" },
-        :desc     => "The 'from' email address for the reports.",
-    },
-
-    :smtpserver => {
-        :default  => "none",
-        :desc     => "The server through which to send email reports.",
-    },
-    :smtpport => {
-        :default  => 25,
-        :desc     => "The TCP port through which to send email reports.",
-    },
-    :smtphelo => {
-        :default  => lambda { Facter.value 'fqdn' },
-        :desc     => "The name by which we identify ourselves in SMTP HELO for reports.
-          If you send to a smtpserver which does strict HELO checking (as with Postfix's
-          `smtpd_helo_restrictions` access controls), you may need to ensure this resolves.",
-    }
-  )
-
-    define_settings(
-    :rails,
-    :dblocation => {
-      :default  => "$statedir/clientconfigs.sqlite3",
-      :type     => :file,
-      :mode     => "0660",
-      :owner    => "service",
-      :group    => "service",
-      :desc     => "The sqlite database file. #{STORECONFIGS_ONLY}"
-    },
-    :dbadapter => {
-      :default  => "sqlite3",
-      :desc     => "The type of database to use. #{STORECONFIGS_ONLY}",
-    },
-    :dbmigrate => {
-      :default  => false,
-      :type     => :boolean,
-      :desc     => "Whether to automatically migrate the database. #{STORECONFIGS_ONLY}",
-    },
-    :dbname => {
-      :default  => "puppet",
-      :desc     => "The name of the database to use. #{STORECONFIGS_ONLY}",
-    },
-    :dbserver => {
-      :default  => "localhost",
-      :desc     => "The database server for caching. Only
-      used when networked databases are used.",
-    },
-    :dbport => {
-      :default  => "",
-      :desc     => "The database password for caching. Only
-        used when networked databases are used. #{STORECONFIGS_ONLY}",
-    },
-    :dbuser => {
-      :default  => "puppet",
-      :desc     => "The database user for caching. Only
-        used when networked databases are used. #{STORECONFIGS_ONLY}",
-    },
-    :dbpassword => {
-      :default  => "puppet",
-      :desc     => "The database password for caching. Only
-        used when networked databases are used. #{STORECONFIGS_ONLY}",
-    },
-    :dbconnections => {
-      :default  => '',
-      :desc     => "The number of database connections for networked
-        databases.  Will be ignored unless the value is a positive integer. #{STORECONFIGS_ONLY}",
-    },
-    :dbsocket => {
-      :default  => "",
-      :desc     => "The database socket location. Only used when networked
-        databases are used.  Will be ignored if the value is an empty string. #{STORECONFIGS_ONLY}",
-    },
-    :railslog => {
-      :default  => "$logdir/rails.log",
-      :type     => :file,
-      :mode     => "0600",
-      :owner    => "service",
-      :group    => "service",
-      :desc     => "Where Rails-specific logs are sent. #{STORECONFIGS_ONLY}"
-    },
-
-    :rails_loglevel => {
-        :default  => "info",
-        :desc     => "The log level for Rails connections.  The value must be
-          a valid log level within Rails.  Production environments normally use `info`
-          and other environments normally use `debug`. #{STORECONFIGS_ONLY}",
-    }
-  )
-
-    define_settings(
-    :couchdb,
-
-    :couchdb_url => {
-        :default  => "http://127.0.0.1:5984/puppet",
-        :desc     => "The url where the puppet couchdb database will be created.
-          Only used when `facts_terminus` is set to `couch`.",
-    }
-  )
-
-    define_settings(
+  define_settings(
     :transaction,
     :tags => {
       :default    => "",
@@ -1993,11 +1647,10 @@ EOT
       :default  => false,
       :type     => :boolean,
       :desc     => "Whether to store each client's configuration, including catalogs, facts,
-        and related data.  This also enables the import and export of resources in
+        and related data. This also enables the import and export of resources in
         the Puppet language - a mechanism for exchange resources between nodes.
 
-        By default this uses ActiveRecord and an SQL database to store and query
-        the data; this, in turn, will depend on Rails being available.
+        By default this uses the 'puppetdb' backend.
 
         You can adjust the backend using the storeconfigs_backend setting.",
       # Call our hook with the default value, so we always get the libdir set.
@@ -2006,71 +1659,23 @@ EOT
         require 'puppet/node'
         require 'puppet/node/facts'
         if value
-          if not Puppet.settings[:async_storeconfigs]
-            Puppet::Resource::Catalog.indirection.cache_class = :store_configs
-            Puppet.settings.override_default(:catalog_cache_terminus, :store_configs)
-          end
+          Puppet::Resource::Catalog.indirection.cache_class = :store_configs
+          Puppet.settings.override_default(:catalog_cache_terminus, :store_configs)
           Puppet::Node::Facts.indirection.cache_class = :store_configs
-
           Puppet::Resource.indirection.terminus_class = :store_configs
         end
       end
     },
     :storeconfigs_backend => {
       :type => :terminus,
-      :default => "active_record",
+      :default => "puppetdb",
       :desc => "Configure the backend terminus used for StoreConfigs.
-        By default, this uses the ActiveRecord store, which directly talks to the
-        database from within the Puppet Master process."
+        By default, this uses the PuppetDB store, which must be installed
+        and configured before turning on StoreConfigs."
     }
   )
 
   define_settings(:parser,
-    :templatedir => {
-        :default  => "$vardir/templates",
-        :type     => :directory,
-        :desc     => "Where Puppet looks for template files.  Can be a list of colon-separated
-          directories.
-
-          This setting is deprecated. Please put your templates in modules instead.",
-        :deprecated => :completely,
-    },
-
-    :allow_variables_with_dashes => {
-      :default => false,
-      :desc    => <<-'EOT'
-        Permit hyphens (`-`) in variable names and issue deprecation warnings about
-        them. This setting **should always be `false`;** setting it to `true`
-        will cause subtle and wide-ranging bugs. It will be removed in a future version.
-
-        Hyphenated variables caused major problems in the language, but were allowed
-        between Puppet 2.7.3 and 2.7.14. If you used them during this window, we
-        apologize for the inconvenience --- you can temporarily set this to `true`
-        in order to upgrade, and can rename your variables at your leisure. Please
-        revert it to `false` after you have renamed all affected variables.
-      EOT
-    },
-    :parser => {
-      :default => "current",
-      :hook    => proc do |value|
-        envs = Puppet.lookup(:environments) { nil }
-        envs.clear_all unless envs.nil?
-      end,
-      :desc => <<-'EOT'
-        Selects the parser to use for parsing puppet manifests (in puppet DSL
-        language/'.pp' files). Available choices are `current` (the default)
-        and `future`.
-
-        The `current` parser means that the released version of the parser should
-        be used.
-
-        The `future` parser is a "time travel to the future" allowing early
-        exposure to new language features. What these features are will vary from
-        release to release and they may be invididually configurable.
-
-        Available Since Puppet 3.2.
-      EOT
-    },
    :max_errors => {
      :default => 10,
      :desc => <<-'EOT'