puppet 6.15.0-x64-mingw32 → 6.19.1-x64-mingw32

data/lib/puppet/defaults.rb

@@ -347,8 +347,7 @@ module Puppet
       :default => "ansi",
       :type    => :string,
       :desc    => "Whether to use colors when logging to the console.  Valid values are
-        `ansi` (equivalent to `true`), `html`, and `false`, which produces no color.
-        Defaults to false on Windows, as its console does not support ansi colors.",
+        `ansi` (equivalent to `true`), `html`, and `false`, which produces no color."
     },
     :mkusers => {
         :default  => false,
@@ -375,7 +374,7 @@ module Puppet
           from the parent process.
 
           This setting can only be set in the `[main]` section of puppet.conf; it cannot
-          be set in `[master]`, `[agent]`, or an environment config section.",
+          be set in `[server]`, `[agent]`, or an environment config section.",
         :call_hook => :on_define_and_write,
         :hook             => proc do |value|
           Puppet::Util.set_env('PATH', '') if Puppet::Util.get_env('PATH').nil?
@@ -563,7 +562,7 @@ module Puppet
         config = File.expand_path(File.join(settings[:confdir], 'hiera.yaml')) if config.nil?
         config
       end,
-      :desc    => "The hiera configuration file. Puppet only reads this file on startup, so you must restart the puppet master every time you edit it.",
+      :desc    => "The hiera configuration file. Puppet only reads this file on startup, so you must restart the puppet server every time you edit it.",
       :type    => :file,
     },
     :binder_config => {
@@ -590,13 +589,22 @@ module Puppet
     },
     :trusted_external_command => {
       :default  => nil,
-      :desc     => "The external trusted facts script to use.
+      :type     => :file_or_directory,
+      :desc     => "The external trusted facts script or directory to use.
         This setting's value can be set to the path to an executable command that
-        can produce external trusted facts. The command must:
+        can produce external trusted facts or to a directory containing those
+        executable commands. The command(s) must:
 
         * Take the name of a node as a command-line argument.
         * Return a JSON hash with the external trusted facts for this node.
-        * For unknown or invalid nodes, exit with a non-zero exit code.",
+        * For unknown or invalid nodes, exit with a non-zero exit code.
+
+        If the setting points to an executable command, then the external trusted
+        facts will be stored in the 'external' key of the trusted facts hash. Otherwise
+        for each executable file in the directory, the external trusted facts will be
+        stored in the `<basename>` key of the `trusted['external']` hash. For example,
+        if the files foo.rb and bar.sh are in the directory, then `trusted['external']`
+        will be the hash `{ 'foo' => <foo.rb output>, 'bar' => <bar.sh output> }`.",
     },
     :default_file_terminus => {
       :type       => :terminus,
@@ -692,40 +700,54 @@ Valid values are 0 (never cache) and 15 (15 second minimum wait time).
     :environment_timeout => {
       :default    => "0",
       :type       => :ttl,
-      :desc       => "How long the Puppet master should cache data it loads from an
+      :desc       => "How long the Puppet server should cache data it loads from an
       environment.
 
       A value of `0` will disable caching. This setting can also be set to
-      `unlimited`, which will cache environments until the master is restarted
-      or told to refresh the cache.
+      `unlimited`, which will cache environments until the server is restarted
+      or told to refresh the cache. All other values will result in Puppet
+      server evicting expired environments. The expiration time is computed
+      based on either when the environment was created or last accessed, see
+      `environment_timeout_mode`.
 
       You should change this setting once your Puppet deployment is doing
       non-trivial work. We chose the default value of `0` because it lets new
       users update their code without any extra steps, but it lowers the
-      performance of your Puppet master.
-
-      We recommend setting this to `unlimited` and explicitly refreshing your
-      Puppet master as part of your code deployment process.
-
-      * With Puppet Server, you should refresh environments by calling the
-        `environment-cache` API endpoint. See the docs for the Puppet Server
-        [administrative API](https://puppet.com/docs/puppetserver/latest/admin-api/v1/environment-cache.html).
-
-      Any value other than `0` or `unlimited` is deprecated, since most Puppet
-      servers use a pool of Ruby interpreters which all have their own cache
-      timers. When these timers drift out of sync, agents can be served
-      inconsistent catalogs.",
+      performance of your Puppet server. We recommend either:
+
+      * Setting this to `unlimited` and explicitly refreshing your Puppet server
+        as part of your code deployment process.
+
+      * Setting this to a number that will keep your most actively used
+        environments cached, but allow testing environments to fall out of the
+        cache and reduce memory usage. A value of 3 minutes (3m) is a reasonable
+        value. This option requires setting `environment_timeout_mode` to
+        `from_last_used`.
+
+      Once you set `environment_timeout` to a non-zero value, you need to tell
+      Puppet server to read new code from disk using the `environment-cache` API
+      endpoint after you deploy new code. See the docs for the Puppet Server
+      [administrative API](https://puppet.com/docs/puppetserver/latest/admin-api/v1/environment-cache.html).
+      ",
       :hook => proc do |val|
-        unless [0, 'unlimited', Float::INFINITY].include?(val)
-          Puppet.deprecation_warning(<<-WARNING)
-Fine grained control of environment timeouts is deprecated,
-please use `0` or `unlimited` to control default caching behavior
-and the environment-cache endpoint in Puppet Server's administrative
-API to expire the cache as needed
-          WARNING
+        if Puppet[:environment_timeout_mode] == :from_created
+          unless [0, 'unlimited', Float::INFINITY].include?(val)
+            Puppet.deprecation_warning("Evicting environments based on their creation time is deprecated, please set `environment_timeout_mode` to `from_last_used` instead.")
+          end
         end
       end
     },
+    :environment_timeout_mode => {
+      :default => :from_created,
+      :type    => :symbolic_enum,
+      :values  => [:from_created, :from_last_used],
+      :desc => "How Puppet interprets the `environment_timeout` setting when
+      `environment_timeout` is neither `0` nor `unlimited`. If set to
+      `from_created`, then the environment will be evicted `environment_timeout`
+      seconds from when it was created. If set to `from_last_used` then the
+      environment will be evicted `environment_timeout` seconds from when it
+      was last used."
+    },
     :environment_data_provider => {
       :desc       => "The name of a registered environment data provider used when obtaining environment
       specific data. The three built in and registered providers are 'none' (no data), 'function' (data
@@ -814,7 +836,9 @@ API to expire the cache as needed
           only use lowercase letters, numbers, periods, underscores, and dashes. (That is,
           it should match `/\A[a-z0-9._-]+\Z/`.)
         * The special value `ca` is reserved, and can't be used as the certname
-          for a normal node.
+          for a normal node.         
+
+          **Note:** You must set the certname in the main section of the puppet.conf file. Setting it in a different section causes errors.
 
         Defaults to the node's fully qualified domain name.",
       :hook => proc { |value| raise(ArgumentError, _("Certificate names must be lower case")) unless value == value.downcase }},
@@ -992,6 +1016,15 @@ EOT
         and reject the CA certificate if the values do not match. This only applies
         during the first download of the CA certificate."
     },
+    :ssl_trust_store => {
+      :default => nil,
+      :type => :file,
+      :desc => "A file containing CA certificates in PEM format that puppet should trust
+        when making HTTPS requests. This **only** applies to https requests to non-puppet
+        infrastructure, such as retrieving file metadata and content from https file sources,
+        puppet module tool and the 'http' report processor. This setting is ignored when
+        making requests to puppet:// URLs such as catalog and report requests.",
+    },
     :ssl_client_ca_auth => {
       :type  => :file,
       :mode  => "0644",
@@ -1284,7 +1317,7 @@ EOT
     }
   )
 
-  settings.define_settings(:master,
+  settings.define_settings(:server,
     :user => {
       :default    => "puppet",
       :desc       => "The user Puppet Server will run as. Used to ensure
@@ -1334,11 +1367,23 @@ EOT
       by `puppet`, and should only be set if you're writing your own Puppet
       executable.",
     },
+    :serverport => {
+      :default    => 8140,
+      :desc       => "The default port puppet subcommands use to communicate
+      with Puppet Server. (eg `puppet facts upload`, `puppet agent`). May be
+      overridden by more specific settings (see `ca_port`, `report_port`).",
+      :hook       => proc do |value|
+        Puppet[:masterport] = value unless Puppet.settings.set_by_config?(:masterport)
+      end
+    },
     :masterport => {
       :default    => 8140,
       :desc       => "The default port puppet subcommands use to communicate
       with Puppet Server. (eg `puppet facts upload`, `puppet agent`). May be
       overridden by more specific settings (see `ca_port`, `report_port`).",
+      :hook => proc do |value|
+        Puppet[:serverport] = value unless Puppet.settings.set_by_config?(:serverport)
+      end
     },
     :node_name => {
       :default    => 'cert',
@@ -1536,7 +1581,7 @@ EOT
     :statefile => {
       :default => "$statedir/state.yaml",
       :type => :file,
-      :mode => "0660",
+      :mode => "0640",
       :desc => "Where puppet agent and puppet master store state associated
         with the running configuration.  In the case of puppet master,
         this file reflects the state discovered through interacting
@@ -1558,7 +1603,7 @@ EOT
     :transactionstorefile => {
       :default => "$statedir/transactionstore.yaml",
       :type => :file,
-      :mode => "0660",
+      :mode => "0640",
       :desc => "Transactional storage file for persisting data between
         transactions for the purposes of infering information (such as
         corrective_change) on new data received."
@@ -1684,8 +1729,7 @@ EOT
       :type     => :duration,
       :desc     => "How often puppet agent applies the catalog.
           Note that a runinterval of 0 means \"run continuously\" rather than
-          \"never run.\" If you want puppet agent to never run, you should start
-          it with the `--no-client` option. #{AS_DURATION}",
+          \"never run.\" #{AS_DURATION}",
     },
     :runtimeout => {
       :default  => "1h",
@@ -1701,7 +1745,7 @@ EOT
       and does not need to horizontally scale.",
     },
     :ca_port => {
-      :default    => "$masterport",
+      :default    => "$serverport",
       :desc       => "The port to use for the certificate authority.",
     },
     :preferred_serialization_format => {
@@ -1790,7 +1834,7 @@ EOT
       :desc     => "The server to send transaction reports to.",
     },
     :report_port => {
-      :default  => "$masterport",
+      :default  => "$serverport",
       :desc     => "The port to communicate with the report_server.",
     },
     :report => {
@@ -1882,6 +1926,25 @@ EOT
       certificate request to be signed. A value of `unlimited` will cause puppet agent
       to ask for a signed certificate indefinitely.
       #{AS_DURATION}",
+    },
+    :waitforlock => {
+      :default  => "0",
+      :type     => :duration,
+      :desc     => "How frequently puppet agent should try running when there is an
+      already ongoing puppet agent instance.
+
+      This argument is by default disabled (value set to 0). In this case puppet agent will
+      immediately exit if it cannot run at that moment. When a value other than 0 is set, this
+      can also be used in combination with the `maxwaitforlock` argument.
+      #{AS_DURATION}",
+    },
+    :maxwaitforlock => {
+      :default  => "1m",
+      :type     => :ttl,
+      :desc     => "The maximum amount of time the puppet agent should wait for an
+      already running puppet agent to finish before starting a new one. This is set by default to 1 minute.
+      A value of `unlimited` will cause puppet agent to wait indefinitely. 
+      #{AS_DURATION}",
     }
   )
 
@@ -1922,9 +1985,26 @@ EOT
       is used for retrieval, so anything that is a valid file source can
       be used here.",
     },
+    :pluginsync => {
+      :default    => true,
+      :type       => :boolean,
+      :desc       => "Whether plugins should be synced with the central server. This setting is
+        deprecated.",
+      :hook => proc { |value|
+        #TRANSLATORS 'pluginsync' is a setting and should not be translated
+        Puppet.deprecation_warning(_("Setting 'pluginsync' is deprecated."))
+      }
+    },
     :pluginsignore => {
         :default  => ".svn CVS .git .hg",
         :desc     => "What files to ignore when pulling down plugins.",
+    },
+    :ignore_plugin_errors => {
+      :default    => true,
+      :type       => :boolean,
+      :desc       => "Whether the puppet run should ignore errors during pluginsync. If the setting
+        is false and there are errors during pluginsync, then the agent will abort the run and
+        submit a report containing information about the failed run."
     }
   )
 
@@ -2069,7 +2149,7 @@ EOT
     }
   )
 
-  settings.define_settings(:master,
+  settings.define_settings(:server,
     :storeconfigs => {
       :default  => false,
       :type     => :boolean,

data/lib/puppet/environments.rb

@@ -159,8 +159,8 @@ module Puppet::Environments
   # Reads environments from a directory on disk. Each environment is
   # represented as a sub-directory. The environment's manifest setting is the
   # `manifest` directory of the environment directory. The environment's
-  # modulepath setting is the global modulepath (from the `[master]` section
-  # for the master) prepended with the `modules` directory of the environment
+  # modulepath setting is the global modulepath (from the `[server]` section
+  # for the server) prepended with the `modules` directory of the environment
   # directory.
   #
   # @api private
@@ -277,7 +277,7 @@ module Puppet::Environments
     def get(name)
       @loaders.each do |loader|
         env = loader.get(name)
-        if env 
+        if env
           return env
         end
       end
@@ -305,13 +305,23 @@ module Puppet::Environments
     include Puppet::Concurrent::Synchronized
 
     class DefaultCacheExpirationService
+      # Called when the environment is created.
+      #
+      # @param [Puppet::Node::Environment] env
       def created(env)
       end
 
+      # Is the environment with this name expired?
+      #
+      # @param [Symbol] env_name The symbolic environment name
+      # @return [Boolean]
       def expired?(env_name)
         false
       end
 
+      # The environment with this name was evicted.
+      #
+      # @param [Symbol] env_name The symbolic environment name
       def evicted(env_name)
       end
     end
@@ -362,7 +372,9 @@ module Puppet::Environments
       clear_all_expired
       result = @cache[name]
       if result
+        Puppet.debug {"Found in cache '#{name}' #{result.label}"}
         # found in cache
+        result.touch
         return result.value
       elsif (result = @loader.get(name))
         # environment loaded, cache it
@@ -411,7 +423,7 @@ module Puppet::Environments
       to_expire = @cache.select { |name, entry| entry.expires < t || @cache_expiration_service.expired?(name.to_sym) }
       to_expire.each do |name, entry|
         Puppet.debug {"Evicting cache entry for environment '#{name}'"}
-        @cache_expiration_service.evicted(name)
+        @cache_expiration_service.evicted(name.to_sym)
         clear(name)
         @expirations.delete(entry.expires)
         Puppet.settings.clear_environment_settings(name)
@@ -435,23 +447,32 @@ module Puppet::Environments
     # Creates a suitable cache entry given the time to live for one environment
     #
     def entry(env)
-      ttl = (conf = get_conf(env.name)) ? conf.environment_timeout : Puppet.settings.value(:environment_timeout)
+      ttl = if (conf = get_conf(env.name))
+              conf.environment_timeout
+            else
+              Puppet[:environment_timeout]
+            end
+
       case ttl
       when 0
         NotCachedEntry.new(env)     # Entry that is always expired (avoids syscall to get time)
       when Float::INFINITY
         Entry.new(env)              # Entry that never expires (avoids syscall to get time)
       else
-        TTLEntry.new(env, ttl)
+        if Puppet[:environment_timeout_mode] == :from_last_used
+          MRUEntry.new(env, ttl)    # Entry that expires in ttl from when it was last touched
+        else
+          TTLEntry.new(env, ttl)    # Entry that expires in ttl from when it was created
+        end
       end
     end
 
     # Evicts the entry if it has expired
     # Also clears caches in Settings that may prevent the entry from being updated
     def evict_if_expired(name)
-      if (result = @cache[name]) && (result.expired? || @cache_expiration_service.expired?(name))
+      if (result = @cache[name]) && (result.expired? || @cache_expiration_service.expired?(name.to_sym))
         Puppet.debug {"Evicting cache entry for environment '#{name}'"}
-        @cache_expiration_service.evicted(name)
+        @cache_expiration_service.evicted(name.to_sym)
         clear(name)
         Puppet.settings.clear_environment_settings(name)
       end
@@ -465,6 +486,9 @@ module Puppet::Environments
         @value = value
       end
 
+      def touch
+      end
+
       def expired?
         false
       end
@@ -493,10 +517,10 @@ module Puppet::Environments
       end
     end
 
-    # Time to Live eviction policy entry
+    # Policy that expires in ttl_seconds from when it was created
     class TTLEntry < Entry
       def initialize(value, ttl_seconds)
-        super value
+        super(value)
         @ttl = Time.now + ttl_seconds
         @ttl_seconds = ttl_seconds
       end
@@ -513,5 +537,22 @@ module Puppet::Environments
         @ttl
       end
     end
+
+    # Policy that expires if it hasn't been touched within ttl_seconds
+    class MRUEntry < TTLEntry
+      def initialize(value, ttl_seconds)
+        super(value, ttl_seconds)
+
+        touch
+      end
+
+      def touch
+        @ttl = Time.now + @ttl_seconds
+      end
+
+      def label
+        "(mru = #{@ttl_seconds} sec)"
+      end
+    end
   end
 end

data/lib/puppet/face/catalog.rb

@@ -97,7 +97,7 @@ Puppet::Indirector::Face.define(:catalog, '0.0.1') do
       A serialized catalog.
     EOT
     when_invoked do |*args|
-      Puppet.settings.preferred_run_mode = :master
+      Puppet.settings.preferred_run_mode = :server
       Puppet::Face[:catalog, :current].find(*args)
     end
   end

data/lib/puppet/face/config.rb

@@ -20,10 +20,10 @@ Puppet::Face.define(:config, '0.0.1') do
     description <<-EOT
       The section of the puppet.conf configuration file to interact with.
 
-      The three most commonly used sections are 'main', 'master', and 'agent'.
+      The three most commonly used sections are 'main', 'server', and 'agent'.
       'Main' is the default, and is used by all Puppet applications. Other
       sections can override 'main' values for specific applications --- the
-      'master' section affects Puppet Server, and the 'agent'
+      'server' section affects Puppet Server, and the 'agent'
       section affects puppet agent.
 
       Less commonly used is the 'user' section, which affects puppet apply. Any
@@ -52,9 +52,9 @@ Puppet::Face.define(:config, '0.0.1') do
 
       $ puppet config print rundir
 
-      Get a list of important directories from the master's config:
+      Get a list of important directories from the server's config:
 
-      $ puppet config print all --section master | grep -E "(path|dir)"
+      $ puppet config print all --section server | grep -E "(path|dir)"
     EOT
 
     when_invoked do |*args|
@@ -144,7 +144,7 @@ Puppet::Face.define(:config, '0.0.1') do
 
       if name == 'environment' && options[:section] == 'main'
         Puppet.warning _(<<-EOM).chomp
-The environment should be set in either the `[user]`, `[agent]`, or `[master]`
+The environment should be set in either the `[user]`, `[agent]`, or `[server]`
 section. Variables set in the `[agent]` section are used when running
 `puppet agent`. Variables set in the `[user]` section are used when running
 various other puppet subcommands, like `puppet apply` and `puppet module`; these
@@ -163,7 +163,24 @@ https://puppet.com/docs/puppet/latest/configuration.html#environment
       Puppet::FileSystem.touch(path)
       Puppet::FileSystem.open(path, nil, 'r+:UTF-8') do |file|
         Puppet::Settings::IniFile.update(file) do |config|
-          config.set(options[:section], name, value)
+          if options[:section] == "master"
+            # delete requested master section if it exists,
+            # as server section should be used
+            setting_string = config.delete("master", name)
+            if setting_string
+
+              if Puppet::Util::Log.sendlevel?(:info)
+                report_section_and_environment(options[:section], Puppet.settings[:environment])
+              end
+
+              puts(_("Deleted setting from '%{section_name}': '%{setting_string}', and adding it to 'server' section") %
+                       { section_name: options[:section], name: name, setting_string: setting_string.strip })
+            end
+            # add the setting to the to server section instead of master section
+            config.set("server", name, value)
+          else
+            config.set(options[:section], name, value)
+          end
         end
       end
       nil
@@ -185,9 +202,9 @@ https://puppet.com/docs/puppet/latest/configuration.html#environment
 
       $ puppet config delete setting_name
 
-      Delete the setting 'setting_name' from the 'master' configuration domain:
+      Delete the setting 'setting_name' from the 'server' configuration domain:
 
-      $ puppet config delete setting_name --section master
+      $ puppet config delete setting_name --section server
     EOT
 
     when_invoked do |name, options|
@@ -202,18 +219,31 @@ https://puppet.com/docs/puppet/latest/configuration.html#environment
       if Puppet::FileSystem.exist?(path)
         Puppet::FileSystem.open(path, nil, 'r+:UTF-8') do |file|
           Puppet::Settings::IniFile.update(file) do |config|
-            setting_string = config.delete(options[:section], name)
-            if setting_string
 
-              if Puppet::Util::Log.sendlevel?(:info)
-                report_section_and_environment(options[:section], Puppet.settings[:environment])
-              end
+            # delete from both master section and server section
+            if options[:section] == "master" || options[:section] == "server"
+              master_setting_string = config.delete("master", name)
+              puts(_("Deleted setting from '%{section_name}': '%{setting_string}'") %
+              { section_name: 'master', name: name, setting_string: master_setting_string.strip[/[^=]+/] }) if master_setting_string
 
+              server_setting_string = config.delete("server", name)
               puts(_("Deleted setting from '%{section_name}': '%{setting_string}'") %
-                       { section_name: options[:section], name: name, setting_string: setting_string.strip })
+              { section_name: 'server', name: name, setting_string: server_setting_string.strip[/[^=]+/] }) if server_setting_string
+
             else
-              Puppet.warning(_("No setting found in configuration file for section '%{section_name}' setting name '%{name}'") %
-                                 { section_name: options[:section], name: name })
+              setting_string = config.delete(options[:section], name)
+              if setting_string
+
+                if Puppet::Util::Log.sendlevel?(:info)
+                  report_section_and_environment(options[:section], Puppet.settings[:environment])
+                end
+
+                puts(_("Deleted setting from '%{section_name}': '%{setting_string}'") %
+                         { section_name: options[:section], name: name, setting_string: setting_string.strip })
+              else
+                Puppet.warning(_("No setting found in configuration file for section '%{section_name}' setting name '%{name}'") %
+                                   { section_name: options[:section], name: name })
+              end
             end
           end
         end