puppet 6.14.0 → 6.19.0

data/lib/puppet/confine/any.rb

@@ -19,7 +19,7 @@ class Puppet::Confine::Any < Puppet::Confine
     if @values.any? { |value| pass?(value) }
       true
     else
-      Puppet.debug("#{label}: #{message(@values)}")
+      Puppet.debug { "#{label}: #{message(@values)}" }
       false
     end
   end

data/lib/puppet/context/trusted_information.rb

@@ -29,11 +29,6 @@ class Puppet::Context::TrustedInformation
   # @return [String]
   attr_reader :hostname
 
-  # Additional external facts loaded through `trusted_external_command`.
-  #
-  # @return [Hash]
-  attr_reader :external
-
   def initialize(authenticated, certname, extensions, external = {})
     @authenticated = authenticated.freeze
     @certname = certname.freeze
@@ -46,11 +41,11 @@ class Puppet::Context::TrustedInformation
     end
     @hostname = hostname.freeze
     @domain = domain.freeze
-    @external = external.freeze
+    @external = external.is_a?(Proc) ? external : external.freeze
   end
 
   def self.remote(authenticated, node_name, certificate)
-    external = retrieve_trusted_external(node_name)
+    external = proc { retrieve_trusted_external(node_name) }
 
     if authenticated
       extensions = {}
@@ -70,8 +65,19 @@ class Puppet::Context::TrustedInformation
   def self.local(node)
     # Always trust local data by picking up the available parameters.
     client_cert = node ? node.parameters['clientcert'] : nil
+    external = proc { retrieve_trusted_external(client_cert) }
+
+    new('local', client_cert, {}, external)
+  end
 
-    new('local', client_cert, {}, retrieve_trusted_external(client_cert))
+  # Additional external facts loaded through `trusted_external_command`.
+  #
+  # @return [Hash]
+  def external
+    if @external.is_a?(Proc)
+      @external = @external.call.freeze
+    end
+    @external
   end
 
   def self.retrieve_trusted_external(certname)

data/lib/puppet/daemon.rb

@@ -1,19 +1,15 @@
 require 'puppet/application'
 require 'puppet/scheduler'
 
-# Run periodic actions and a network server in a daemonized process.
+# Run periodic actions in a daemonized process.
 #
-# A Daemon has 3 parts:
+# A Daemon has 2 parts:
 #   * config reparse
-#   * (optional) an agent that responds to #run
-#   * (optional) a server that response to #stop, #start, and #wait_for_shutdown
+#   * an agent that responds to #run
 #
-# The config reparse will occur periodically based on Settings. The server will
-# be started and is expected to manage its own run loop (and so not block the
-# start call). The server will, however, still be waited for by using the
-# #wait_for_shutdown method. The agent is run periodically and a time interval
-# based on Settings. The config reparse will update this time interval when
-# needed.
+# The config reparse will occur periodically based on Settings. The agent
+# is run periodically and a time interval based on Settings. The config
+# reparse will update this time interval when needed.
 #
 # The Daemon is also responsible for signal handling, starting, stopping,
 # running the agent on demand, and reloading the entire process. It ensures
@@ -23,12 +19,14 @@ require 'puppet/scheduler'
 class Puppet::Daemon
   SIGNAL_CHECK_INTERVAL = 5
 
-  attr_accessor :agent, :server, :argv
-  attr_reader :signals
+  attr_accessor :argv
+  attr_reader :signals, :agent
 
-  def initialize(pidfile, scheduler = Puppet::Scheduler::Scheduler.new())
+  def initialize(agent, pidfile, scheduler = Puppet::Scheduler::Scheduler.new())
+    raise Puppet::DevError, _("Daemons must have an agent") unless agent
     @scheduler = scheduler
     @pidfile = pidfile
+    @agent = agent
     @signals = []
   end
 
@@ -88,7 +86,6 @@ class Puppet::Daemon
   end
 
   def reload
-    return unless agent
     agent.run({:splay => false})
   rescue Puppet::LockError
     Puppet.notice "Not triggering already-running agent"
@@ -96,7 +93,7 @@ class Puppet::Daemon
 
   def restart
     Puppet::Application.restart!
-    reexec unless agent and agent.running?
+    reexec
   end
 
   def reopen_logs
@@ -129,8 +126,6 @@ class Puppet::Daemon
   def stop(args = {:exit => true})
     Puppet::Application.stop!
 
-    server.stop if server
-
     remove_pidfile
 
     Puppet::Util::Log.close_all
@@ -140,16 +135,7 @@ class Puppet::Daemon
 
   def start
     create_pidfile
-
-    raise Puppet::DevError, _("Daemons must have an agent, server, or both") unless agent or server
-
-    # Start the listening server, if required.
-    server.start if server
-
-    # Finally, loop forever running events - or, at least, until we exit.
     run_event_loop
-
-    server.wait_for_shutdown if server
   end
 
   private
@@ -165,6 +151,7 @@ class Puppet::Daemon
     @pidfile.unlock
   end
 
+  # Loop forever running events - or, at least, until we exit.
   def run_event_loop
     agent_run = Puppet::Scheduler.create_job(Puppet[:runinterval], Puppet[:splay], Puppet[:splaylimit]) do
       # Splay for the daemon is handled in the scheduler
@@ -189,7 +176,6 @@ class Puppet::Daemon
     end
 
     reparse_run.disable if Puppet[:filetimeout] == 0
-    agent_run.disable unless agent
 
     @scheduler.run_loop([reparse_run, agent_run, signal_loop])
   end

data/lib/puppet/defaults.rb

@@ -81,7 +81,10 @@ module Puppet
             begin
               original_facter = Object.const_get(:Facter)
               Object.send(:remove_const, :Facter)
+
               require 'facter-ng'
+              # It is required to re-setup logger for facter-ng
+              Puppet::Util::Logging.setup_facter_logging!
             rescue LoadError
               Object.const_set(:Facter, original_facter)
               raise ArgumentError, 'facter-ng could not be loaded'
@@ -344,8 +347,7 @@ module Puppet
       :default => "ansi",
       :type    => :string,
       :desc    => "Whether to use colors when logging to the console.  Valid values are
-        `ansi` (equivalent to `true`), `html`, and `false`, which produces no color.
-        Defaults to false on Windows, as its console does not support ansi colors.",
+        `ansi` (equivalent to `true`), `html`, and `false`, which produces no color."
     },
     :mkusers => {
         :default  => false,
@@ -372,7 +374,7 @@ module Puppet
           from the parent process.
 
           This setting can only be set in the `[main]` section of puppet.conf; it cannot
-          be set in `[master]`, `[agent]`, or an environment config section.",
+          be set in `[server]`, `[agent]`, or an environment config section.",
         :call_hook => :on_define_and_write,
         :hook             => proc do |value|
           Puppet::Util.set_env('PATH', '') if Puppet::Util.get_env('PATH').nil?
@@ -560,7 +562,7 @@ module Puppet
         config = File.expand_path(File.join(settings[:confdir], 'hiera.yaml')) if config.nil?
         config
       end,
-      :desc    => "The hiera configuration file. Puppet only reads this file on startup, so you must restart the puppet master every time you edit it.",
+      :desc    => "The hiera configuration file. Puppet only reads this file on startup, so you must restart the puppet server every time you edit it.",
       :type    => :file,
     },
     :binder_config => {
@@ -587,13 +589,22 @@ module Puppet
     },
     :trusted_external_command => {
       :default  => nil,
-      :desc     => "The external trusted facts script to use.
+      :type     => :file_or_directory,
+      :desc     => "The external trusted facts script or directory to use.
         This setting's value can be set to the path to an executable command that
-        can produce external trusted facts. The command must:
+        can produce external trusted facts or to a directory containing those
+        executable commands. The command(s) must:
 
         * Take the name of a node as a command-line argument.
         * Return a JSON hash with the external trusted facts for this node.
-        * For unknown or invalid nodes, exit with a non-zero exit code.",
+        * For unknown or invalid nodes, exit with a non-zero exit code.
+
+        If the setting points to an executable command, then the external trusted
+        facts will be stored in the 'external' key of the trusted facts hash. Otherwise
+        for each executable file in the directory, the external trusted facts will be
+        stored in the `<basename>` key of the `trusted['external']` hash. For example,
+        if the files foo.rb and bar.sh are in the directory, then `trusted['external']`
+        will be the hash `{ 'foo' => <foo.rb output>, 'bar' => <bar.sh output> }`.",
     },
     :default_file_terminus => {
       :type       => :terminus,
@@ -689,40 +700,54 @@ Valid values are 0 (never cache) and 15 (15 second minimum wait time).
     :environment_timeout => {
       :default    => "0",
       :type       => :ttl,
-      :desc       => "How long the Puppet master should cache data it loads from an
+      :desc       => "How long the Puppet server should cache data it loads from an
       environment.
 
       A value of `0` will disable caching. This setting can also be set to
-      `unlimited`, which will cache environments until the master is restarted
-      or told to refresh the cache.
+      `unlimited`, which will cache environments until the server is restarted
+      or told to refresh the cache. All other values will result in Puppet
+      server evicting expired environments. The expiration time is computed
+      based on either when the environment was created or last accessed, see
+      `environment_timeout_mode`.
 
       You should change this setting once your Puppet deployment is doing
       non-trivial work. We chose the default value of `0` because it lets new
       users update their code without any extra steps, but it lowers the
-      performance of your Puppet master.
-
-      We recommend setting this to `unlimited` and explicitly refreshing your
-      Puppet master as part of your code deployment process.
-
-      * With Puppet Server, you should refresh environments by calling the
-        `environment-cache` API endpoint. See the docs for the Puppet Server
-        [administrative API](https://puppet.com/docs/puppetserver/latest/admin-api/v1/environment-cache.html).
-
-      Any value other than `0` or `unlimited` is deprecated, since most Puppet
-      servers use a pool of Ruby interpreters which all have their own cache
-      timers. When these timers drift out of sync, agents can be served
-      inconsistent catalogs.",
+      performance of your Puppet server. We recommend either:
+
+      * Setting this to `unlimited` and explicitly refreshing your Puppet server
+        as part of your code deployment process.
+
+      * Setting this to a number that will keep your most actively used
+        environments cached, but allow testing environments to fall out of the
+        cache and reduce memory usage. A value of 3 minutes (3m) is a reasonable
+        value. This option requires setting `environment_timeout_mode` to
+        `from_last_used`.
+
+      Once you set `environment_timeout` to a non-zero value, you need to tell
+      Puppet server to read new code from disk using the `environment-cache` API
+      endpoint after you deploy new code. See the docs for the Puppet Server
+      [administrative API](https://puppet.com/docs/puppetserver/latest/admin-api/v1/environment-cache.html).
+      ",
       :hook => proc do |val|
-        unless [0, 'unlimited', Float::INFINITY].include?(val)
-          Puppet.deprecation_warning(<<-WARNING)
-Fine grained control of environment timeouts is deprecated,
-please use `0` or `unlimited` to control default caching behavior
-and the environment-cache endpoint in Puppet Server's administrative
-API to expire the cache as needed
-          WARNING
+        if Puppet[:environment_timeout_mode] == :from_created
+          unless [0, 'unlimited', Float::INFINITY].include?(val)
+            Puppet.deprecation_warning("Evicting environments based on their creation time is deprecated, please set `environment_timeout_mode` to `from_last_used` instead.")
+          end
         end
       end
     },
+    :environment_timeout_mode => {
+      :default => :from_created,
+      :type    => :symbolic_enum,
+      :values  => [:from_created, :from_last_used],
+      :desc => "How Puppet interprets the `environment_timeout` setting when
+      `environment_timeout` is neither `0` nor `unlimited`. If set to
+      `from_created`, then the environment will be evicted `environment_timeout`
+      seconds from when it was created. If set to `from_last_used` then the
+      environment will be evicted `environment_timeout` seconds from when it
+      was last used."
+    },
     :environment_data_provider => {
       :desc       => "The name of a registered environment data provider used when obtaining environment
       specific data. The three built in and registered providers are 'none' (no data), 'function' (data
@@ -811,7 +836,9 @@ API to expire the cache as needed
           only use lowercase letters, numbers, periods, underscores, and dashes. (That is,
           it should match `/\A[a-z0-9._-]+\Z/`.)
         * The special value `ca` is reserved, and can't be used as the certname
-          for a normal node.
+          for a normal node.         
+
+          **Note:** You must set the certname in the main section of the puppet.conf file. Setting it in a different section causes errors.
 
         Defaults to the node's fully qualified domain name.",
       :hook => proc { |value| raise(ArgumentError, _("Certificate names must be lower case")) unless value == value.downcase }},
@@ -989,6 +1016,15 @@ EOT
         and reject the CA certificate if the values do not match. This only applies
         during the first download of the CA certificate."
     },
+    :ssl_trust_store => {
+      :default => nil,
+      :type => :file,
+      :desc => "A file containing CA certificates in PEM format that puppet should trust
+        when making HTTPS requests. This **only** applies to https requests to non-puppet
+        infrastructure, such as retrieving file metadata and content from https file sources,
+        puppet module tool and the 'http' report processor. This setting is ignored when
+        making requests to puppet:// URLs such as catalog and report requests.",
+    },
     :ssl_client_ca_auth => {
       :type  => :file,
       :mode  => "0644",
@@ -1281,7 +1317,7 @@ EOT
     }
   )
 
-  settings.define_settings(:master,
+  settings.define_settings(:server,
     :user => {
       :default    => "puppet",
       :desc       => "The user Puppet Server will run as. Used to ensure
@@ -1331,11 +1367,23 @@ EOT
       by `puppet`, and should only be set if you're writing your own Puppet
       executable.",
     },
+    :serverport => {
+      :default    => 8140,
+      :desc       => "The default port puppet subcommands use to communicate
+      with Puppet Server. (eg `puppet facts upload`, `puppet agent`). May be
+      overridden by more specific settings (see `ca_port`, `report_port`).",
+      :hook       => proc do |value|
+        Puppet[:masterport] = value unless Puppet.settings.set_by_config?(:masterport)
+      end
+    },
     :masterport => {
       :default    => 8140,
       :desc       => "The default port puppet subcommands use to communicate
       with Puppet Server. (eg `puppet facts upload`, `puppet agent`). May be
       overridden by more specific settings (see `ca_port`, `report_port`).",
+      :hook => proc do |value|
+        Puppet[:serverport] = value unless Puppet.settings.set_by_config?(:serverport)
+      end
     },
     :node_name => {
       :default    => 'cert',
@@ -1533,7 +1581,7 @@ EOT
     :statefile => {
       :default => "$statedir/state.yaml",
       :type => :file,
-      :mode => "0660",
+      :mode => "0640",
       :desc => "Where puppet agent and puppet master store state associated
         with the running configuration.  In the case of puppet master,
         this file reflects the state discovered through interacting
@@ -1555,7 +1603,7 @@ EOT
     :transactionstorefile => {
       :default => "$statedir/transactionstore.yaml",
       :type => :file,
-      :mode => "0660",
+      :mode => "0640",
       :desc => "Transactional storage file for persisting data between
         transactions for the purposes of infering information (such as
         corrective_change) on new data received."
@@ -1637,7 +1685,7 @@ EOT
       :default => [],
       :type => :http_extra_headers,
       :desc => "The list of extra headers that will be sent with http requests to the master.
-      The header definition consists of a name and a value separated by a colon." 
+      The header definition consists of a name and a value separated by a colon."
     },
     :ignoreschedules => {
       :default    => false,
@@ -1681,8 +1729,7 @@ EOT
       :type     => :duration,
       :desc     => "How often puppet agent applies the catalog.
           Note that a runinterval of 0 means \"run continuously\" rather than
-          \"never run.\" If you want puppet agent to never run, you should start
-          it with the `--no-client` option. #{AS_DURATION}",
+          \"never run.\" #{AS_DURATION}",
     },
     :runtimeout => {
       :default  => "1h",
@@ -1698,7 +1745,7 @@ EOT
       and does not need to horizontally scale.",
     },
     :ca_port => {
-      :default    => "$masterport",
+      :default    => "$serverport",
       :desc       => "The port to use for the certificate authority.",
     },
     :preferred_serialization_format => {
@@ -1787,7 +1834,7 @@ EOT
       :desc     => "The server to send transaction reports to.",
     },
     :report_port => {
-      :default  => "$masterport",
+      :default  => "$serverport",
       :desc     => "The port to communicate with the report_server.",
     },
     :report => {
@@ -1795,10 +1842,27 @@ EOT
       :type     => :boolean,
       :desc     => "Whether to send reports after every transaction.",
     },
+    :report_include_system_store => {
+      :default  => false,
+      :type     => :boolean,
+      :desc     => "Whether the 'http' report processor should include the system
+        certificate store when submitting reports to HTTPS URLs. If false, then
+        the 'http' processor will only trust HTTPS report servers whose certificates
+        are issued by the puppet CA or one of its intermediate CAs. If true, the
+        processor will additionally trust CA certificates in the system's
+        certificate store."
+    },
     :resubmit_facts => {
       :default  => false,
       :type     => :boolean,
-      :desc     => "Whether to send updated facts after every transaction.",
+      :desc     => "Whether to send updated facts after every transaction. By default
+        puppet only submits facts at the beginning of the transaction before applying a
+        catalog. Since puppet can modify the state of the system, the value of the facts
+        may change after puppet finishes. Therefore, any facts stored in puppetdb may not
+        be consistent until the agent next runs, typically in 30 minutes. If this feature
+        is enabled, puppet will resubmit facts after applying its catalog, ensuring facts
+        for the node stored in puppetdb are current. However, this will double the fact
+        submission load on puppetdb, so it is disabled by default.",
     },
     :lastrunfile =>  {
       :default  => "$statedir/last_run_summary.yaml",
@@ -1862,6 +1926,25 @@ EOT
       certificate request to be signed. A value of `unlimited` will cause puppet agent
       to ask for a signed certificate indefinitely.
       #{AS_DURATION}",
+    },
+    :waitforlock => {
+      :default  => "0",
+      :type     => :duration,
+      :desc     => "How frequently puppet agent should try running when there is an
+      already ongoing puppet agent instance.
+
+      This argument is by default disabled (value set to 0). In this case puppet agent will
+      immediately exit if it cannot run at that moment. When a value other than 0 is set, this
+      can also be used in combination with the `maxwaitforlock` argument.
+      #{AS_DURATION}",
+    },
+    :maxwaitforlock => {
+      :default  => "1m",
+      :type     => :ttl,
+      :desc     => "The maximum amount of time the puppet agent should wait for an
+      already running puppet agent to finish before starting a new one. This is set by default to 1 minute.
+      A value of `unlimited` will cause puppet agent to wait indefinitely. 
+      #{AS_DURATION}",
     }
   )
 
@@ -1902,9 +1985,26 @@ EOT
       is used for retrieval, so anything that is a valid file source can
       be used here.",
     },
+    :pluginsync => {
+      :default    => true,
+      :type       => :boolean,
+      :desc       => "Whether plugins should be synced with the central server. This setting is
+        deprecated.",
+      :hook => proc { |value|
+        #TRANSLATORS 'pluginsync' is a setting and should not be translated
+        Puppet.deprecation_warning(_("Setting 'pluginsync' is deprecated."))
+      }
+    },
     :pluginsignore => {
         :default  => ".svn CVS .git .hg",
         :desc     => "What files to ignore when pulling down plugins.",
+    },
+    :ignore_plugin_errors => {
+      :default    => true,
+      :type       => :boolean,
+      :desc       => "Whether the puppet run should ignore errors during pluginsync. If the setting
+        is false and there are errors during pluginsync, then the agent will abort the run and
+        submit a report containing information about the failed run."
     }
   )
 
@@ -2049,7 +2149,7 @@ EOT
     }
   )
 
-  settings.define_settings(:master,
+  settings.define_settings(:server,
     :storeconfigs => {
       :default  => false,
       :type     => :boolean,