puppet 5.3.4 → 6.29.0

data/lib/puppet/agent.rb

@@ -38,38 +38,78 @@ class Puppet::Agent
   # Perform a run with our client.
   def run(client_options = {})
     if disabled?
-      Puppet.notice _("Skipping run of %{client_class}; administratively disabled (Reason: '%{disable_message}');\nUse 'puppet agent --enable' to re-enable.") % { client_class: client_class, disable_message: disable_message }
+      log_disabled_message
       return
     end
 
     result = nil
+    wait_for_lock_deadline = nil
     block_run = Puppet::Application.controlled_run do
-      splay client_options.fetch :splay, Puppet[:splay]
+      # splay may sleep for awhile when running onetime! If not onetime, then
+      # the job scheduler splays (only once) so that agents assign themselves a
+      # slot within the splay interval.
+      do_splay = client_options.fetch(:splay, Puppet[:splay])
+      if do_splay
+        splay(do_splay)
+
+        if disabled?
+          log_disabled_message
+          break
+        end
+      end
+
+      # waiting for certs may sleep for awhile depending on onetime, waitforcert and maxwaitforcert!
+      # this needs to happen before forking so that if we fail to obtain certs and try to exit, then
+      # we exit the main process and not the forked child.
+      ssl_context = wait_for_certificates(client_options)
+
       result = run_in_fork(should_fork) do
         with_client(client_options[:transaction_uuid], client_options[:job_id]) do |client|
           client_args = client_options.merge(:pluginsync => Puppet::Configurer.should_pluginsync?)
           begin
+            # lock may sleep for awhile depending on waitforlock and maxwaitforlock!
             lock do
-              # NOTE: Timeout is pretty heinous as the location in which it
-              # throws an error is entirely unpredictable, which means that
-              # it can interrupt code blocks that perform cleanup or enforce
-              # sanity. The only thing a Puppet agent should do after this
-              # error is thrown is die with as much dignity as possible.
-              Timeout.timeout(Puppet[:runtimeout], RunTimeoutError) do
-                client.run(client_args)
+              if disabled?
+                log_disabled_message
+                nil
+              else
+                # NOTE: Timeout is pretty heinous as the location in which it
+                # throws an error is entirely unpredictable, which means that
+                # it can interrupt code blocks that perform cleanup or enforce
+                # sanity. The only thing a Puppet agent should do after this
+                # error is thrown is die with as much dignity as possible.
+                Timeout.timeout(Puppet[:runtimeout], RunTimeoutError) do
+                  Puppet.override(ssl_context: ssl_context) do
+                    client.run(client_args)
+                  end
+                end
               end
             end
           rescue Puppet::LockError
-            Puppet.notice _("Run of %{client_class} already in progress; skipping  (%{lockfile_path} exists)") % { client_class: client_class, lockfile_path: lockfile_path }
-            return
+            now = Time.now.to_i
+            wait_for_lock_deadline ||= now + Puppet[:maxwaitforlock]
+
+            if Puppet[:waitforlock] < 1
+              Puppet.notice _("Run of %{client_class} already in progress; skipping  (%{lockfile_path} exists)") % { client_class: client_class, lockfile_path: lockfile_path }
+              nil
+            elsif now >= wait_for_lock_deadline
+              Puppet.notice _("Exiting now because the maxwaitforlock timeout has been exceeded.")
+              nil
+            else
+              Puppet.info _("Another puppet instance is already running; --waitforlock flag used, waiting for running instance to finish.")
+              Puppet.info _("Will try again in %{time} seconds.") % {time: Puppet[:waitforlock]}
+              sleep Puppet[:waitforlock]
+              retry
+            end
           rescue RunTimeoutError => detail
             Puppet.log_exception(detail, _("Execution of %{client_class} did not complete within %{runtimeout} seconds and was terminated.") %
-              {client_class: client_class,
-              runtimeout: Puppet[:runtimeout]})
-            return 1
+              {client_class: client_class, runtimeout: Puppet[:runtimeout]})
+            nil
           rescue StandardError => detail
             Puppet.log_exception(detail, _("Could not run %{client_class}: %{detail}") % { client_class: client_class, detail: detail })
-            1
+            nil
+          ensure
+            Puppet.runtime[:http].close
           end
         end
       end
@@ -95,11 +135,9 @@ class Puppet::Agent
         atForkHandler.child
         $0 = _("puppet agent: applying configuration")
         begin
-          exit(yield)
-        rescue SystemExit
-          exit(-1)
+          exit(yield || 1)
         rescue NoMemoryError
-          exit(-2)
+          exit(254)
         end
       end
     ensure
@@ -107,12 +145,6 @@ class Puppet::Agent
     end
 
     exit_code = Process.waitpid2(child_pid)
-    case exit_code[1].exitstatus
-    when -1
-      raise SystemExit
-    when -2
-      raise NoMemoryError
-    end
     exit_code[1].exitstatus
   end
 
@@ -122,7 +154,7 @@ class Puppet::Agent
   # to it during the yield.
   def with_client(transaction_uuid, job_id = nil)
     begin
-      @client = client_class.new(Puppet::Configurer::DownloaderFactory.new, transaction_uuid, job_id)
+      @client = client_class.new(transaction_uuid, job_id)
     rescue StandardError => detail
       Puppet.log_exception(detail, _("Could not create instance of %{client_class}: %{detail}") % { client_class: client_class, detail: detail })
       return
@@ -131,4 +163,14 @@ class Puppet::Agent
   ensure
     @client = nil
   end
+
+  def wait_for_certificates(options)
+    waitforcert = options[:waitforcert] || (Puppet[:onetime] ? 0 : Puppet[:waitforcert])
+    sm = Puppet::SSL::StateMachine.new(waitforcert: waitforcert, onetime: Puppet[:onetime])
+    sm.ensure_client_certificate
+  end
+
+  def log_disabled_message
+    Puppet.notice _("Skipping run of %{client_class}; administratively disabled (Reason: '%{disable_message}');\nUse 'puppet agent --enable' to re-enable.") % { client_class: client_class, disable_message: disable_message }
+  end
 end

data/lib/puppet/application/agent.rb

@@ -39,6 +39,7 @@ class Puppet::Application::Agent < Puppet::Application
       :graph => true,
       :fingerprint => false,
       :sourceaddress => nil,
+      :start_time => Time.now,
     }.each do |opt,val|
       options[opt] = val
     end
@@ -90,7 +91,7 @@ puppet-agent(8) -- #{summary}
 
 SYNOPSIS
 --------
-Retrieves the client configuration from the puppet master and applies it to
+Retrieves the client configuration from the Puppet master and applies it to
 the local host.
 
 This service may be run as a daemon, run periodically using cron (or something
@@ -102,7 +103,7 @@ USAGE
 puppet agent [--certname <NAME>] [-D|--daemonize|--no-daemonize]
   [-d|--debug] [--detailed-exitcodes] [--digest <DIGEST>] [--disable [MESSAGE]] [--enable]
   [--fingerprint] [-h|--help] [-l|--logdest syslog|eventlog|<ABS FILEPATH>|console]
-  [--masterport <PORT>] [--noop] [-o|--onetime] [--sourceaddress <IP_ADDRESS>] [-t|--test]
+  [--serverport <PORT>] [--noop] [-o|--onetime] [--sourceaddress <IP_ADDRESS>] [-t|--test]
   [-v|--verbose] [-V|--version] [-w|--waitforcert <SECONDS>]
 
 
@@ -124,31 +125,38 @@ configuration and apply it.
 USAGE NOTES
 -----------
 'puppet agent' does its best to find a compromise between interactive
-use and daemon use. Run with no arguments and no configuration, it will
-go into the background, attempt to get a signed certificate, and retrieve
-and apply its configuration every 30 minutes.
+use and daemon use. If you run it with no arguments and no configuration, it
+goes into the background, attempts to get a signed certificate, and retrieves
+and applies its configuration every 30 minutes.
 
-Some flags are meant specifically for interactive use -- in particular,
+Some flags are meant specifically for interactive use --- in particular,
 'test', 'tags' and 'fingerprint' are useful.
 
-'--test' does a single run in the foreground with verbose logging, then exits.
-It will also exit if it can't get a valid catalog. The exit code after running
-with '--test' is 0 if the catalog was successfully applied, and 1 if the run
-either failed or wasn't attempted (due to another run already in progress).
+'--test' runs once in the foreground with verbose logging, then exits.
+It also exits if it can't get a valid catalog. `--test` includes the 
+'--detailed-exitcodes' option by default and exits with one of the following 
+exit codes:
+
+* 0: The run succeeded with no changes or failures; the system was already in 
+     the desired state.
+* 1: The run failed, or wasn't attempted due to another run already in progress.
+* 2: The run succeeded, and some resources were changed.
+* 4: The run succeeded, and some resources failed.
+* 6: The run succeeded, and included both changes and failures.
 
 '--tags' allows you to specify what portions of a configuration you want
 to apply. Puppet elements are tagged with all of the class or definition
 names that contain them, and you can use the 'tags' flag to specify one
 of these names, causing only configuration elements contained within
 that class or definition to be applied. This is very useful when you are
-testing new configurations -- for instance, if you are just starting to
+testing new configurations --- for instance, if you are just starting to
 manage 'ntpd', you would put all of the new elements into an 'ntpd'
 class, and call puppet with '--tags ntpd', which would only apply that
 small portion of the configuration during your testing, rather than
 applying the whole thing.
 
-'--fingerprint' is a one-time flag. In this mode 'puppet agent' will run
-once and display on the console (and in the log) the current certificate
+'--fingerprint' is a one-time flag. In this mode 'puppet agent' runs
+once and displays on the console (and in the log) the current certificate
 (or certificate request) fingerprint. Providing the '--digest' option
 allows to use a different digest algorithm to generate the fingerprint.
 The main use is to verify that before signing a certificate request on
@@ -156,17 +164,22 @@ the master, the certificate request the master received is the same as
 the one the client sent (to prevent against man-in-the-middle attacks
 when signing certificates).
 
+'--skip_tags' is a flag used to filter resources. If this is set, then
+only resources not tagged with the specified tags will be applied.
+Values must be comma-separated.
+
 
 OPTIONS
 -------
 
 Note that any Puppet setting that's valid in the configuration file is also a
 valid long argument. For example, 'server' is a valid setting, so you can
-specify '--server <servername>' as an argument. Boolean settings translate into
-'--setting' and '--no-setting' pairs.
+specify '--server <servername>' as an argument. Boolean settings accept a '--no-' 
+prefix to turn off a behavior, translating into '--setting' and '--no-setting' 
+pairs, such as `--daemonize` and `--no-daemonize`.
 
 See the configuration file documentation at
-https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for the
+https://puppet.com/docs/puppet/latest/configuration.html for the
 full list of acceptable settings. A commented list of all settings can also be
 generated by running puppet agent with '--genconfig'.
 
@@ -192,8 +205,8 @@ generated by running puppet agent with '--genconfig'.
   Enable full debugging.
 
 * --detailed-exitcodes:
-  Provide extra information about the run via exit codes; only works if '--test'
-  or '--onetime' is also specified. If enabled, 'puppet agent' will use the
+  Provide extra information about the run via exit codes; works only if '--test'
+  or '--onetime' is also specified. If enabled, 'puppet agent' uses the
   following exit codes:
 
   0: The run succeeded with no changes or failures; the system was already in
@@ -230,10 +243,15 @@ generated by running puppet agent with '--genconfig'.
 * --enable:
   Enable working on the local system. This removes any lock file,
   causing 'puppet agent' to start managing the local system again
-  (although it will continue to use its normal scheduling, so it might
-  not start for another half hour).
+  However, it continues to use its normal scheduling, so it might
+  not start for another half hour.
 
   'puppet agent' exits after executing this.
+  
+*  --evaltrace:
+  Logs each resource as it is being evaluated. This allows you to interactively
+  see exactly what is being done. (This is a Puppet setting, and can go in
+  puppet.conf. Note the special 'no-' prefix for boolean settings on the command line.)
 
 * --fingerprint:
   Display the current certificate or certificate signing request
@@ -245,26 +263,34 @@ generated by running puppet agent with '--genconfig'.
 
 * --job-id:
   Attach the specified job id to the catalog request and the report used for
-  this agent run. This option only works when '--onetime' is used.
+  this agent run. This option only works when '--onetime' is used.  When using
+  Puppet Enterprise this flag should not be used as the orchestrator sets the
+  job-id for you and it must be unique.
 
 * --logdest:
   Where to send log messages. Choose between 'syslog' (the POSIX syslog
   service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
   file. If debugging or verbosity is enabled, this defaults to 'console'.
   Otherwise, it defaults to 'syslog' on POSIX systems and 'eventlog' on Windows.
+  Multiple destinations can be set using a comma separated list 
+  (eg: `/path/file1,console,/path/file2`)"
 
   A path ending with '.json' will receive structured output in JSON format. The
   log file will not have an ending ']' automatically written to it due to the
   appending nature of logging. It must be appended manually to make the content
   valid JSON.
 
+  A path ending with '.jsonl' will receive structured output in JSON Lines
+  format.
+
 * --masterport:
-  The port on which to contact the puppet master.
-  (This is a Puppet setting, and can go in puppet.conf.)
+  The port on which to contact the Puppet Server.
+  (This is a Puppet setting, and can go in puppet.conf.
+  Deprecated in favor of the 'serverport' setting.)
 
 * --noop:
   Use 'noop' mode where the daemon runs in a no-op or dry-run mode. This
-  is useful for seeing what changes Puppet will make without actually
+  is useful for seeing what changes Puppet would make without actually
   executing the changes.
   (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
   prefix for boolean settings on the command line.)
@@ -276,6 +302,10 @@ generated by running puppet agent with '--genconfig'.
   (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
   prefix for boolean settings on the command line.)
 
+* --serverport:
+  The port on which to contact the Puppet Server.
+  (This is a Puppet setting, and can go in puppet.conf.)
+
 * --sourceaddress:
   Set the source IP address for transactions. This defaults to automatically selected.
   (This is a Puppet setting, and can go in puppet.conf.)
@@ -284,6 +314,10 @@ generated by running puppet agent with '--genconfig'.
   Enable the most common options used for testing. These are 'onetime',
   'verbose', 'no-daemonize', 'no-usecacheonfailure', 'detailed-exitcodes',
   'no-splay', and 'show_diff'.
+  
+* --trace
+  Prints stack traces on some errors. (This is a Puppet setting, and can go in
+  puppet.conf. Note the special 'no-' prefix for boolean settings on the command line.)
 
 * --verbose:
   Turn on verbose reporting.
@@ -298,9 +332,12 @@ generated by running puppet agent with '--genconfig'.
   it to sign a certificate request. This is useful for the initial setup
   of a puppet client. You can turn off waiting for certificates by
   specifying a time of 0.
-  (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
-  prefix for boolean settings on the command line.)
+  (This is a Puppet setting, and can go in puppet.conf.)
 
+* --write_catalog_summary
+  After compiling the catalog saves the resource list and classes list to the node
+  in the state directory named classes.txt and resources.txt
+  (This is a Puppet setting, and can go in puppet.conf.)
 
 EXAMPLE
 -------
@@ -344,32 +381,56 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
       # Setup signal traps immediately after daemonization so we clean up the daemon
       daemon.set_signal_traps
 
-      wait_for_certificates
-
-      if Puppet[:onetime]
-        onetime(daemon)
-      else
-        main(daemon)
+      log_config if Puppet[:daemonize]
+
+      # Each application is responsible for pushing loaders onto the context.
+      # Use the current environment that has already been established, though
+      # it may change later during the configurer run.
+      env = Puppet.lookup(:current_environment)
+      Puppet.override(current_environment: env,
+                      loaders: Puppet::Pops::Loaders.new(env, true)) do
+        if Puppet[:onetime]
+          onetime(daemon)
+        else
+          main(daemon)
+        end
       end
     end
   end
 
-  def fingerprint
-    host = Puppet::SSL::Host.new
-    unless cert = host.certificate || host.certificate_request
-      $stderr.puts _("Fingerprint asked but no certificate nor certificate request have yet been issued")
-      exit(1)
-      return
+  def log_config
+    #skip also config reading and parsing if debug is not enabled
+    return unless Puppet::Util::Log.sendlevel?(:debug)
+
+    Puppet.settings.stringify_settings(:agent, :all).each_pair do |k,v|
+      next if k.include?("password") || v.to_s.empty?
+      Puppet.debug("Using setting: #{k}=#{v}")
     end
-    unless digest = cert.digest(options[:digest].to_s)
-      raise ArgumentError, _("Could not get fingerprint for digest '%{digest}'") % { digest: options[:digest] }
+  end
+
+  def fingerprint
+    Puppet::Util::Log.newdestination(:console)
+    cert_provider = Puppet::X509::CertProvider.new
+    client_cert = cert_provider.load_client_cert(Puppet[:certname])
+    if client_cert
+      puts Puppet::SSL::Digest.new(options[:digest].to_s, client_cert.to_der).to_s
+    else
+      csr = cert_provider.load_request(Puppet[:certname])
+      if csr
+        puts Puppet::SSL::Digest.new(options[:digest].to_s, csr.to_der).to_s
+      else
+        $stderr.puts _("Fingerprint asked but neither the certificate, nor the certificate request have been issued")
+        exit(1)
+      end
     end
-    puts digest.to_s
+  rescue => e
+    Puppet.log_exception(e, _("Failed to generate fingerprint: %{message}") % {message: e.message})
+    exit(1)
   end
 
   def onetime(daemon)
     begin
-      exitstatus = daemon.agent.run(:job_id => options[:job_id])
+      exitstatus = daemon.agent.run({:job_id => options[:job_id], :start_time => options[:start_time], :waitforcert => options[:waitforcert]})
     rescue => detail
       Puppet.log_exception(detail)
     end
@@ -422,18 +483,12 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
     # we want the last report to be persisted locally
     Puppet::Transaction::Report.indirection.cache_class = :yaml
 
-    if Puppet[:noop]
-      Puppet::Resource::Catalog.indirection.cache_class = nil
-    elsif Puppet[:catalog_cache_terminus]
+    if Puppet[:catalog_cache_terminus]
       Puppet::Resource::Catalog.indirection.cache_class = Puppet[:catalog_cache_terminus]
     end
 
-    if options[:fingerprint]
-      # in fingerprint mode we just need
-      # access to the local files and we don't need a ca
-      Puppet::SSL::Host.ca_location = :none
-    else
-      Puppet::SSL::Host.ca_location = :remote
+    # In fingerprint mode we don't need to set up the whole agent
+    unless options[:fingerprint]
       setup_agent
     end
   end
@@ -458,18 +513,11 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
   end
 
   def daemonize_process_when(should_daemonize)
-    daemon = Puppet::Daemon.new(Puppet::Util::Pidlock.new(Puppet[:pidfile]))
+    daemon = Puppet::Daemon.new(@agent, Puppet::Util::Pidlock.new(Puppet[:pidfile]))
     daemon.argv = @argv
-    daemon.agent = @agent
 
     daemon.daemonize if should_daemonize
 
     daemon
   end
-
-  def wait_for_certificates
-    host = Puppet::SSL::Host.new
-    waitforcert = options[:waitforcert] || (Puppet[:onetime] ? 0 : Puppet[:waitforcert])
-    host.wait_for_cert(waitforcert)
-  end
 end