puppet 6.22.1-x64-mingw32 → 6.25.1-x64-mingw32

data/spec/unit/configurer_spec.rb

@@ -2,11 +2,27 @@ require 'spec_helper'
 require 'puppet/configurer'
 
 describe Puppet::Configurer do
+  include PuppetSpec::Files
+
   before do
     Puppet[:server] = "puppetmaster"
     Puppet[:report] = true
 
     catalog.add_resource(resource)
+    allow_any_instance_of(described_class).to(
+      receive(:valid_server_environment?).and_return(true)
+    )
+
+    Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
+    ---
+    version:
+      config: 1624882680
+      puppet: #{Puppet.version}
+    application:
+      initial_environment: #{Puppet[:environment]}
+      converged_environment: #{Puppet[:environment]}
+      run_mode: agent
+    SUMMARY
   end
 
   let(:node_name) { Puppet[:node_name_value] }
@@ -78,10 +94,10 @@ describe Puppet::Configurer do
       configurer.run(:pluginsync => false)
     end
 
-    it "should carry on when it can't fetch its node definition" do
-      error = Net::HTTPError.new(400, 'dummy server communication error')
-      expect(Puppet::Node.indirection).to receive(:find).and_raise(error)
-      expect(configurer.run).to eq(0)
+    it "does not download plugins when specified environment is not vaild on server" do
+      expect(configurer).to receive(:valid_server_environment?).and_return(false)
+      expect(configurer).not_to receive(:download_plugins)
+      configurer.run(:pluginsync => true)
     end
 
     it "fails the run if pluginsync fails when usecacheonfailure is false" do
@@ -125,7 +141,6 @@ describe Puppet::Configurer do
     it "applies a cached catalog when it can't connect to the master" do
       error = Errno::ECONNREFUSED.new('Connection refused - connect(2)')
 
-      expect(Puppet::Node.indirection).to receive(:find).and_raise(error)
       expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(:ignore_cache => true)).and_raise(error)
       expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(:ignore_terminus => true)).and_return(catalog)
 
@@ -461,7 +476,7 @@ describe Puppet::Configurer do
     it "should save the report if reporting is enabled" do
       Puppet.settings[:report] = true
 
-      expect(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, instance_of(Hash))
+      expect(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, instance_of(Hash)).twice
       configurer.send_report(report)
     end
 
@@ -489,12 +504,22 @@ describe Puppet::Configurer do
     it "should log but not fail if saving the report fails" do
       Puppet.settings[:report] = true
 
-      expect(Puppet::Transaction::Report.indirection).to receive(:save).and_raise("whatever")
+      expect(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, hash_including(ignore_cache: true)).and_raise("whatever")
+      expect(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, hash_including(ignore_terminus: true))
 
       configurer.send_report(report)
 
       expect(@logs).to include(an_object_having_attributes(level: :err, message: 'Could not send report: whatever'))
     end
+
+    it "should save the cached report if fails to send the report" do
+      allow(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, hash_including(ignore_terminus: true)).and_call_original
+      allow(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, hash_including(ignore_cache: true)).and_raise("whatever")
+
+      expect(File).to_not be_exist(Puppet[:lastrunfile])
+      configurer.send_report(report)
+      expect(File.read(Puppet[:lastrunfile])).to match(/puppet: #{Puppet::PUPPETVERSION}/)
+    end
   end
 
   describe "when saving the summary report file" do
@@ -553,24 +578,6 @@ describe Puppet::Configurer do
     end
   end
 
-  describe "when requesting a node" do
-    it "uses the transaction uuid in the request" do
-      expect(Puppet::Node.indirection).to receive(:find).with(anything, hash_including(transaction_uuid: anything)).twice
-      configurer.run
-    end
-
-    it "sends an explicitly configured environment request" do
-      expect(Puppet.settings).to receive(:set_by_config?).with(:environment).and_return(true)
-      expect(Puppet::Node.indirection).to receive(:find).with(anything, hash_including(configured_environment: Puppet[:environment])).twice
-      configurer.run
-    end
-
-    it "does not send a configured_environment when using the default" do
-      expect(Puppet::Node.indirection).to receive(:find).with(anything, hash_including(configured_environment: nil)).twice
-      configurer.run
-    end
-  end
-
   def expects_pluginsync
     metadata = "[{\"path\":\"/etc/puppetlabs/code\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":0,\"group\":0,\"mode\":420,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-07-10 14:00:00 -0700\"},\"type\":\"directory\",\"destination\":null}]"
     stub_request(:get, %r{/puppet/v3/file_metadatas/(plugins|locales)}).to_return(status: 200, body: metadata, headers: {'Content-Type' => 'application/json'})
@@ -581,7 +588,7 @@ describe Puppet::Configurer do
   end
 
   def expects_new_catalog_only(catalog)
-    expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true)).and_return(catalog)
+    expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true, check_environment: true)).and_return(catalog)
     expect(Puppet::Resource::Catalog.indirection).not_to receive(:find).with(anything, hash_including(ignore_terminus: true))
   end
 
@@ -598,7 +605,7 @@ describe Puppet::Configurer do
   def expects_fallback_to_new_catalog(catalog)
     expects_pluginsync
     expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_terminus: true)).and_return(nil)
-    expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true)).and_return(catalog)
+    expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true, check_environment: true)).and_return(catalog)
   end
 
   def expects_neither_new_or_cached_catalog
@@ -622,21 +629,13 @@ describe Puppet::Configurer do
         configurer.run
       end
 
-      it "should not make a node request or pluginsync when a cached catalog is successfully retrieved" do
-        expect(Puppet::Node.indirection).not_to receive(:find)
+      it "should not pluginsync when a cached catalog is successfully retrieved" do
         expects_cached_catalog_only(catalog)
         expect(configurer).not_to receive(:download_plugins)
 
         configurer.run
       end
 
-      it "should make a node request and pluginsync when a cached catalog cannot be retrieved" do
-        expect(Puppet::Node.indirection).to receive(:find).and_return(nil)
-        expects_fallback_to_new_catalog(catalog)
-
-        configurer.run
-      end
-
       it "should set its cached_catalog_status to 'explicitly_requested'" do
         expects_cached_catalog_only(catalog)
 
@@ -668,7 +667,6 @@ describe Puppet::Configurer do
       end
 
       it "should not attempt to retrieve a cached catalog again if the first attempt failed" do
-        expect(Puppet::Node.indirection).to receive(:find).and_return(nil)
         expects_neither_new_or_cached_catalog
         expects_pluginsync
 
@@ -724,16 +722,6 @@ describe Puppet::Configurer do
         Puppet.settings[:strict_environment_mode] = true
       end
 
-      it "should not make a node request" do
-        stub_request(:get, %r{/puppet/v3/file_metadatas?/plugins}).to_return(:status => 404)
-        stub_request(:get, %r{/puppet/v3/file_metadatas?/pluginfacts}).to_return(:status => 404)
-        expects_new_catalog_only(catalog)
-
-        expect(Puppet::Node.indirection).not_to receive(:find)
-
-        configurer.run
-      end
-
       it "should return nil when the catalog's environment doesn't match the agent specified environment" do
         Puppet[:environment] = 'second_env'
         configurer = Puppet::Configurer.new
@@ -767,7 +755,7 @@ describe Puppet::Configurer do
           expect(configurer.run).to be_nil
         end
 
-        it "should proceed with the cached catalog if its environment matchs the local environment" do
+        it "should proceed with the cached catalog if its environment matches the local environment" do
           expects_cached_catalog_only(catalog)
 
           expect(configurer.run).to eq(0)
@@ -947,9 +935,23 @@ describe Puppet::Configurer do
       expect(Puppet::Resource::Catalog.indirection).to receive(:find).and_return(apple, banana, banana)
 
       allow(Puppet).to receive(:notice)
+      allow(Puppet).to receive(:push_context)
       expect(Puppet).to receive(:notice).with("Local environment: 'production' doesn't match server specified environment 'apple', restarting agent run with environment 'apple'")
       expect(Puppet).to receive(:notice).with("Local environment: 'apple' doesn't match server specified environment 'banana', restarting agent run with environment 'banana'")
 
+      expect(Puppet).to receive(:push_context).with(
+        hash_including(current_environment: an_object_having_attributes(name: :production)),
+        'Local node environment production for configurer transaction'
+      )
+      expect(Puppet).to receive(:push_context).with(
+        hash_including(current_environment: an_object_having_attributes(name: :apple)),
+        'Local node environment apple for configurer transaction'
+      )
+      expect(Puppet).to receive(:push_context).with(
+        hash_including(current_environment: an_object_having_attributes(name: :banana)),
+        'Local node environment banana for configurer transaction'
+      )
+
       configurer.run
     end
 
@@ -1072,6 +1074,29 @@ describe Puppet::Configurer do
       }.to raise_error(Puppet::Error, /Could not select a functional puppet server from server_list: 'myserver:123,someotherservername'/)
     end
 
+    it "should warn when servers in 'server_list' are unreachable" do
+      Puppet.settings[:server_list] = "mybadserver1:123,mybadserver2:123,mygoodserver"
+      Puppet[:usecacheonfailure] = false
+
+      stub_request(:get, 'https://mybadserver1:123/status/v1/simple/master').and_raise(Puppet::HTTP::HTTPError)
+      stub_request(:get, 'https://mybadserver2:123/status/v1/simple/master').and_raise(Puppet::HTTP::HTTPError)
+      stub_request(:get, 'https://mygoodserver:8140/status/v1/simple/master').to_return(status: 200)
+      
+      expect(Puppet).to receive(:warning).with(/^Unable to connect to server from server_list setting:.*Trying with next server from server_list.$/).twice
+      configurer.run
+    end
+
+    it "should warn when servers in 'server_list' respond with error" do
+      Puppet.settings[:server_list] = "mybadserver:123,someotherservername"
+      Puppet[:usecacheonfailure] = false
+
+      stub_request(:get, 'https://mybadserver:123/status/v1/simple/master').to_return(status: 400)
+      stub_request(:get, 'https://someotherservername:8140/status/v1/simple/master').to_return(status: 200)
+
+      expect(Puppet).to receive(:warning).with(/^Puppet server mybadserver:123 is unavailable: 400  Trying with next server from server_list.$/)
+      configurer.run
+    end
+
     it "should not error when usecacheonfailure is true and no servers in 'server_list' are reachable" do
       Puppet.settings[:server_list] = "myserver:123,someotherservername"
       Puppet[:usecacheonfailure] = true
@@ -1084,20 +1109,194 @@ describe Puppet::Configurer do
       expect(configurer.run(options)).to eq(0)
       expect(options[:report].server_used).to be_nil
     end
+  end
 
-    it "should not make multiple node requests when the server is found" do
-      Puppet.settings[:server_list] = ["myserver:123"]
+  describe "when selecting an environment" do
+    include PuppetSpec::Settings
 
-      Puppet::Node.indirection.terminus_class = :rest
-      Puppet::Resource::Catalog.indirection.terminus_class = :rest
+    describe "when the last used environment is available" do
+      let(:last_server_specified_environment) { 'development' }
 
-      stub_request(:get, 'https://myserver:123/status/v1/simple/master').to_return(status: 200)
-      stub_request(:post, %r{https://myserver:123/puppet/v3/catalog}).to_return(status: 200)
-      node_request = stub_request(:get, %r{https://myserver:123/puppet/v3/node/}).to_return(status: 200)
+      before do
+        Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
+        ---
+        version:
+          config: 1624882680
+          puppet: 6.24.0
+        application:
+          initial_environment: #{Puppet[:environment]}
+          converged_environment: #{last_server_specified_environment}
+          run_mode: agent
+        SUMMARY
 
-      configurer.run
+        expect(Puppet::Node.indirection).not_to receive(:find)
+          .with(anything, hash_including(:ignore_cache => true, :fail_on_404 => true))
+      end
 
-      expect(node_request).to have_been_requested.once
+      it "prefers the environment set via cli" do
+        Puppet.settings.handlearg('--environment', 'usethis')
+        configurer.run
+
+        expect(configurer.environment).to eq('usethis')
+      end
+
+      it "prefers the environment set via lastrunfile over config" do
+        FileUtils.mkdir_p(Puppet[:confdir])
+        set_puppet_conf(Puppet[:confdir], <<~CONF)
+        [main]
+        environment = usethis
+        lastrunfile = #{Puppet[:lastrunfile]}
+        CONF
+
+        Puppet.initialize_settings
+        configurer.run
+
+        expect(configurer.environment).to eq(last_server_specified_environment)
+      end
+
+      it "uses the environment from Puppet[:environment] if given a catalog" do
+        configurer.run(catalog: catalog)
+
+        expect(configurer.environment).to eq(Puppet[:environment])
+      end
+
+      it "uses the environment from Puppet[:environment] if use_cached_catalog = true" do
+        Puppet[:use_cached_catalog] = true
+        expects_cached_catalog_only(catalog)
+        configurer.run
+
+        expect(configurer.environment).to eq(Puppet[:environment])
+      end
+
+      describe "when the environment is not set via CLI" do
+        it "uses the environment found in lastrunfile if the key exists" do
+          configurer.run
+
+          expect(configurer.environment).to eq(last_server_specified_environment)
+        end
+
+        it "pushes the converged environment found in lastrunfile over the existing context" do
+          initial_env = Puppet::Node::Environment.remote('production')
+          Puppet.push_context(
+            current_environment: initial_env,
+            loaders: Puppet::Pops::Loaders.new(initial_env, true))
+
+          expect(Puppet).to receive(:push_context).with(
+            hash_including(:current_environment, :loaders),
+            "Local node environment #{last_server_specified_environment} for configurer transaction"
+          ).once.and_call_original
+
+          configurer.run
+        end
+
+        it "uses the environment from Puppet[:environment] if strict_environment_mode is set" do
+          Puppet[:strict_environment_mode] = true
+          configurer.run
+
+          expect(configurer.environment).to eq(Puppet[:environment])
+        end
+
+        it "uses the environment from Puppet[:environment] if initial_environment is the same as converged_environment" do
+          Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
+          ---
+          version:
+            config: 1624882680
+            puppet: 6.24.0
+          application:
+            initial_environment: development
+            converged_environment: development
+            run_mode: agent
+          SUMMARY
+          configurer.run
+
+          expect(configurer.environment).to eq(Puppet[:environment])
+        end
+      end
+    end
+
+    describe "when the last used environment is not available" do
+      describe "when the node request succeeds" do
+        let(:node_environment) { Puppet::Node::Environment.remote(:salam) }
+        let(:node) { Puppet::Node.new(Puppet[:node_name_value]) }
+        let(:last_server_specified_environment) { 'development' }
+
+        before do
+          node.environment = node_environment
+
+          allow(Puppet::Node.indirection).to receive(:find)
+          allow(Puppet::Node.indirection).to receive(:find)
+            .with(anything, hash_including(:ignore_cache => true, :fail_on_404 => true))
+            .and_return(node)
+        end
+
+        it "uses the environment from the node request if the run mode doesn't match" do
+          Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
+            ---
+            version:
+              config: 1624882680
+              puppet: 6.24.0
+            application:
+              initial_environment: #{Puppet[:environment]}
+              converged_environment: #{last_server_specified_environment}
+              run_mode: user
+          SUMMARY
+          configurer.run
+
+          expect(configurer.environment).to eq(node_environment.name.to_s)
+        end
+
+        it "uses the environment from the node request if lastrunfile does not contain the expected keys" do
+          Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
+            ---
+            version:
+              config: 1624882680
+              puppet: 6.24.0
+          SUMMARY
+          configurer.run
+
+          expect(configurer.environment).to eq(node_environment.name.to_s)
+        end
+
+        it "uses the environment from the node request if lastrunfile is invalid YAML" do
+          Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
+            Key: 'this is my very very very ' +
+                 'long string'
+          SUMMARY
+          configurer.run
+
+          expect(configurer.environment).to eq(node_environment.name.to_s)
+        end
+
+        it "uses the environment from the node request if lastrunfile exists but is empty" do
+          Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', '')
+          configurer.run
+
+          expect(configurer.environment).to eq(node_environment.name.to_s)
+        end
+
+        it "uses the environment from the node request if the last used one cannot be found" do
+          Puppet[:lastrunfile] = tmpfile('last_run_summary.yaml')
+          configurer.run
+
+          expect(configurer.environment).to eq(node_environment.name.to_s)
+        end
+      end
+
+      describe "when the node request fails" do
+        before do
+          allow(Puppet::Node.indirection).to receive(:find).and_call_original
+          allow(Puppet::Node.indirection).to receive(:find)
+            .with(anything, hash_including(:ignore_cache => true, :fail_on_404 => true))
+            .and_raise(Puppet::Error)
+        end
+
+        it "uses the environment from Puppet[:environment] if the last used one cannot be found" do
+          Puppet[:lastrunfile] = tmpfile('last_run_summary.yaml')
+          configurer.run
+
+          expect(configurer.environment).to eq(Puppet[:environment])
+        end
+      end
     end
   end
 end

data/spec/unit/defaults_spec.rb

@@ -200,6 +200,7 @@ describe "Defaults" do
 
         Object.send(:remove_const, :Facter)
         facter = double('facter')
+        allow(facter).to receive(:on_message)
         allow(facter).to receive(:value).with('facterversion').and_return('3.11.4')
         Object.const_set(:Facter, facter)
 

data/spec/unit/environments_spec.rb

@@ -5,6 +5,14 @@ require 'puppet/file_system'
 describe Puppet::Environments do
   FS = Puppet::FileSystem
 
+  module FsRemove
+    def remove
+      @properties[:directory?] = false
+      @properties[:exist?] = false
+      @properties[:executable?] = false
+    end
+  end
+
   before(:each) do
     Puppet.settings.initialize_global_settings
     Puppet[:environment_timeout] = "unlimited"
@@ -131,6 +139,14 @@ describe Puppet::Environments do
       end
     end
 
+    it "implements guard and unguard" do
+      loader_from(:filesystem => [directory_tree],
+                  :directory => directory_tree.children.first) do |loader|
+        expect(loader.guard('env1')).to be_nil
+        expect(loader.unguard('env1')).to be_nil
+      end
+    end
+
     context "with an environment.conf" do
       let(:envdir) do
         FS::MemoryFile.a_directory(File.expand_path("envdir"), [
@@ -607,6 +623,78 @@ config_version=$vardir/random/scripts
         cached.get(:cached)
       end
 
+      it "does not list deleted environments" do
+        env3 = FS::MemoryFile.a_directory("env3", [
+          FS::MemoryFile.a_regular_file_containing("environment.conf", '')
+        ])
+
+        envdir = FS::MemoryFile.a_directory(File.expand_path("envdir"), [
+          FS::MemoryFile.a_directory("env1", [
+            FS::MemoryFile.a_regular_file_containing("environment.conf", '')
+          ]),
+          FS::MemoryFile.a_directory("env2", [
+            FS::MemoryFile.a_regular_file_containing("environment.conf", '')
+          ]),
+          env3
+        ])
+
+        loader_from(:filesystem => [envdir], :directory => envdir) do |loader|
+          cached = Puppet::Environments::Cached.new(loader)
+          cached.get(:env1)
+          cached.get(:env2)
+          cached.get(:env3)
+          env3.extend(FsRemove).remove
+
+          expect(cached.list).to contain_exactly(environment(:env1),environment(:env2))
+          expect(cached.get(:env3)).to be_nil
+        end
+      end
+
+      it "normalizes environment name to symbol" do
+        env = Puppet::Node::Environment.create(:cached, [])
+        mocked_loader = double('loader')
+
+        expect(mocked_loader).not_to receive(:get).with('cached')
+        expect(mocked_loader).to receive(:get).with(:cached).and_return(env).once
+        expect(mocked_loader).to receive(:get_conf).with(:cached).and_return(Puppet::Settings::EnvironmentConf.static_for(env, 20)).once
+
+        cached = Puppet::Environments::Cached.new(mocked_loader)
+        cached.get('cached')
+        cached.get(:cached)
+      end
+
+      it "caches environment name as symbol and only once" do
+        mocked_loader = double('loader')
+
+        env = Puppet::Node::Environment.create(:cached, [])
+        allow(mocked_loader).to receive(:get).with(:cached).and_return(env)
+        allow(mocked_loader).to receive(:get_conf).with(:cached).and_return(Puppet::Settings::EnvironmentConf.static_for(env, 20))
+
+        cached = Puppet::Environments::Cached.new(mocked_loader)
+        cached.get(:cached)
+        cached.get('cached')
+
+        expect(cached.instance_variable_get(:@cache).keys).to eq([:cached])
+      end
+
+      it "is able to cache multiple environments" do
+        mocked_loader = double('loader')
+
+        env1 = Puppet::Node::Environment.create(:env1, [])
+        allow(mocked_loader).to receive(:get).with(:env1).and_return(env1)
+        allow(mocked_loader).to receive(:get_conf).with(:env1).and_return(Puppet::Settings::EnvironmentConf.static_for(env1, 20))
+
+        env2 = Puppet::Node::Environment.create(:env2, [])
+        allow(mocked_loader).to receive(:get).with(:env2).and_return(env2)
+        allow(mocked_loader).to receive(:get_conf).with(:env2).and_return(Puppet::Settings::EnvironmentConf.static_for(env2, 20))
+
+        cached = Puppet::Environments::Cached.new(mocked_loader)
+        cached.get('env1')
+        cached.get('env2')
+
+        expect(cached.instance_variable_get(:@cache).keys).to eq([:env1, :env2])
+      end
+
       it "returns nil if env not found" do
         cached_loader_from(:filesystem => [directory_tree], :directory => directory_tree.children.first) do |loader|
           expect(loader.get(:doesnotexist)).to be_nil
@@ -662,6 +750,17 @@ config_version=$vardir/random/scripts
         cached.get_conf(:cached)
       end
 
+      it "normalizes environment name to symbol" do
+        env = Puppet::Node::Environment.create(:cached, [])
+        mocked_loader = double('loader')
+        expect(mocked_loader).to receive(:get_conf).with(:cached).and_return(Puppet::Settings::EnvironmentConf.static_for(env, 20)).twice
+
+        cached = Puppet::Environments::Cached.new(mocked_loader)
+
+        cached.get_conf('cached')
+        cached.get_conf(:cached)
+      end
+
       it "returns nil if environment is not found" do
         cached_loader_from(:filesystem => [directory_tree], :directory => directory_tree.children.first) do |loader|
           expect(loader.get_conf(:doesnotexist)).to be_nil
@@ -754,6 +853,83 @@ config_version=$vardir/random/scripts
 
         expect(service.evicted_envs).to eq([:an_environment])
       end
+
+      context "when guarding an environment" do
+        before :each do
+          Puppet[:environment_timeout] = 0
+        end
+
+        let(:name) { :an_environment }
+
+        def with_guard(cached, name, &block)
+          cached.guard(name)
+          begin
+            yield
+          ensure
+            cached.unguard(name)
+          end
+        end
+
+        it "evicts an expired and unguarded environment" do
+          with_environment_loaded(service) do |cached|
+            cached.get!(name)
+          end
+
+          expect(service.created_envs).to eq([name, name])
+          expect(service.evicted_envs).to eq([name])
+        end
+
+        it "does not evict an expired, but guarded environment" do
+          with_environment_loaded(service) do |cached|
+            with_guard(cached, name) do
+              cached.get!(name) # these shouldn't reload
+              cached.get!(name)
+            end
+          end
+
+          expect(service.created_envs).to eq([name])
+          expect(service.evicted_envs).to eq([])
+        end
+
+        it "does not evict an environment marked for expiration, but is guarded" do
+          Puppet[:environment_timeout] = 'unlimited'
+
+          expect(service).to receive(:expired?).never
+
+          with_environment_loaded(service) do |cached|
+            with_guard(cached, name) do
+              cached.get!(name)
+            end
+          end
+
+          expect(service.created_envs).to eq([name])
+          expect(service.evicted_envs).to eq([])
+        end
+
+        it "evicts an environment that is no longer guarded" do
+          with_environment_loaded(service) do |cached|
+            with_guard(cached, name) {}
+
+            cached.get!(name) # this reloads
+          end
+
+          expect(service.created_envs).to eq([name, name])
+          expect(service.evicted_envs).to eq([name])
+        end
+
+        it "can nest guards" do
+          with_environment_loaded(service) do |cached|
+            with_guard(cached, name) do
+              with_guard(cached, name) do
+                cached.get!(name) # doesn't reload
+              end
+            end
+          end
+
+          expect(service.created_envs).to eq([name])
+          expect(service.evicted_envs).to eq([])
+        end
+      end
     end
 
     context '#clear' do
@@ -766,6 +942,14 @@ config_version=$vardir/random/scripts
 
         expect(service.evicted_envs).to eq([:an_environment])
       end
+
+      it "normalizes environment name to symbol" do
+        with_environment_loaded(service) do |cached|
+          cached.clear('an_environment')
+        end
+
+        expect(service.evicted_envs).to eq([:an_environment])
+      end
     end
 
     context '#clear_all' do