puppet 6.25.0-x64-mingw32 → 7.0.0-x64-mingw32

data/spec/unit/configurer_spec.rb

@@ -7,9 +7,6 @@ describe Puppet::Configurer do
     Puppet[:report] = true
 
     catalog.add_resource(resource)
-    allow_any_instance_of(described_class).to(
-      receive(:valid_server_environment?).and_return(true)
-    )
   end
 
   let(:node_name) { Puppet[:node_name_value] }
@@ -81,10 +78,10 @@ describe Puppet::Configurer do
       configurer.run(:pluginsync => false)
     end
 
-    it "does not download plugins when specified environment is not vaild on server" do
-      expect(configurer).to receive(:valid_server_environment?).and_return(false)
-      expect(configurer).not_to receive(:download_plugins)
-      configurer.run(:pluginsync => true)
+    it "should carry on when it can't fetch its node definition" do
+      error = Net::HTTPError.new(400, 'dummy server communication error')
+      expect(Puppet::Node.indirection).to receive(:find).and_raise(error)
+      expect(configurer.run).to eq(0)
     end
 
     it "fails the run if pluginsync fails when usecacheonfailure is false" do
@@ -128,6 +125,7 @@ describe Puppet::Configurer do
     it "applies a cached catalog when it can't connect to the master" do
       error = Errno::ECONNREFUSED.new('Connection refused - connect(2)')
 
+      expect(Puppet::Node.indirection).to receive(:find).and_raise(error)
       expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(:ignore_cache => true)).and_raise(error)
       expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(:ignore_terminus => true)).and_return(catalog)
 
@@ -386,7 +384,7 @@ describe Puppet::Configurer do
 
     it "sets the checksum_type query param to the default supported_checksum_types in a catalog request" do
       expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything,
-        hash_including(checksum_type: 'md5.sha256.sha384.sha512.sha224'))
+        hash_including(checksum_type: 'sha256.sha384.sha512.sha224.md5'))
       configurer.run
     end
 
@@ -463,7 +461,7 @@ describe Puppet::Configurer do
     it "should save the report if reporting is enabled" do
       Puppet.settings[:report] = true
 
-      expect(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, instance_of(Hash)).twice
+      expect(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, instance_of(Hash))
       configurer.send_report(report)
     end
 
@@ -491,22 +489,12 @@ describe Puppet::Configurer do
     it "should log but not fail if saving the report fails" do
       Puppet.settings[:report] = true
 
-      expect(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, hash_including(ignore_cache: true)).and_raise("whatever")
-      expect(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, hash_including(ignore_terminus: true))
+      expect(Puppet::Transaction::Report.indirection).to receive(:save).and_raise("whatever")
 
       configurer.send_report(report)
 
       expect(@logs).to include(an_object_having_attributes(level: :err, message: 'Could not send report: whatever'))
     end
-
-    it "should save the cached report if fails to send the report" do
-      allow(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, hash_including(ignore_terminus: true)).and_call_original
-      allow(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, hash_including(ignore_cache: true)).and_raise("whatever")
-
-      expect(File).to_not be_exist(Puppet[:lastrunfile])
-      configurer.send_report(report)
-      expect(File.read(Puppet[:lastrunfile])).to match(/puppet: #{Puppet::PUPPETVERSION}/)
-    end
   end
 
   describe "when saving the summary report file" do
@@ -565,6 +553,24 @@ describe Puppet::Configurer do
     end
   end
 
+  describe "when requesting a node" do
+    it "uses the transaction uuid in the request" do
+      expect(Puppet::Node.indirection).to receive(:find).with(anything, hash_including(transaction_uuid: anything)).twice
+      configurer.run
+    end
+
+    it "sends an explicitly configured environment request" do
+      expect(Puppet.settings).to receive(:set_by_config?).with(:environment).and_return(true)
+      expect(Puppet::Node.indirection).to receive(:find).with(anything, hash_including(configured_environment: Puppet[:environment])).twice
+      configurer.run
+    end
+
+    it "does not send a configured_environment when using the default" do
+      expect(Puppet::Node.indirection).to receive(:find).with(anything, hash_including(configured_environment: nil)).twice
+      configurer.run
+    end
+  end
+
   def expects_pluginsync
     metadata = "[{\"path\":\"/etc/puppetlabs/code\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":0,\"group\":0,\"mode\":420,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-07-10 14:00:00 -0700\"},\"type\":\"directory\",\"destination\":null}]"
     stub_request(:get, %r{/puppet/v3/file_metadatas/(plugins|locales)}).to_return(status: 200, body: metadata, headers: {'Content-Type' => 'application/json'})
@@ -575,7 +581,7 @@ describe Puppet::Configurer do
   end
 
   def expects_new_catalog_only(catalog)
-    expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true, check_environment: true)).and_return(catalog)
+    expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true)).and_return(catalog)
     expect(Puppet::Resource::Catalog.indirection).not_to receive(:find).with(anything, hash_including(ignore_terminus: true))
   end
 
@@ -592,7 +598,7 @@ describe Puppet::Configurer do
   def expects_fallback_to_new_catalog(catalog)
     expects_pluginsync
     expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_terminus: true)).and_return(nil)
-    expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true, check_environment: true)).and_return(catalog)
+    expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true)).and_return(catalog)
   end
 
   def expects_neither_new_or_cached_catalog
@@ -616,13 +622,21 @@ describe Puppet::Configurer do
         configurer.run
       end
 
-      it "should not pluginsync when a cached catalog is successfully retrieved" do
+      it "should not make a node request or pluginsync when a cached catalog is successfully retrieved" do
+        expect(Puppet::Node.indirection).not_to receive(:find)
         expects_cached_catalog_only(catalog)
         expect(configurer).not_to receive(:download_plugins)
 
         configurer.run
       end
 
+      it "should make a node request and pluginsync when a cached catalog cannot be retrieved" do
+        expect(Puppet::Node.indirection).to receive(:find).and_return(nil)
+        expects_fallback_to_new_catalog(catalog)
+
+        configurer.run
+      end
+
       it "should set its cached_catalog_status to 'explicitly_requested'" do
         expects_cached_catalog_only(catalog)
 
@@ -643,6 +657,8 @@ describe Puppet::Configurer do
       end
 
       it "should pluginsync and compile a new catalog if none is found in the cache" do
+        Puppet[:ignore_plugin_errors] = true
+
         expects_fallback_to_new_catalog(catalog)
         stub_request(:get, %r{/puppet/v3/file_metadatas?/plugins}).to_return(:status => 404)
         stub_request(:get, %r{/puppet/v3/file_metadatas?/pluginfacts}).to_return(:status => 404)
@@ -654,6 +670,9 @@ describe Puppet::Configurer do
       end
 
       it "should not attempt to retrieve a cached catalog again if the first attempt failed" do
+        Puppet[:ignore_plugin_errors] = true
+
+        expect(Puppet::Node.indirection).to receive(:find).and_return(nil)
         expects_neither_new_or_cached_catalog
         expects_pluginsync
 
@@ -709,6 +728,16 @@ describe Puppet::Configurer do
         Puppet.settings[:strict_environment_mode] = true
       end
 
+      it "should not make a node request" do
+        stub_request(:get, %r{/puppet/v3/file_metadatas?/plugins}).to_return(:status => 404)
+        stub_request(:get, %r{/puppet/v3/file_metadatas?/pluginfacts}).to_return(:status => 404)
+        expects_new_catalog_only(catalog)
+
+        expect(Puppet::Node.indirection).not_to receive(:find)
+
+        configurer.run
+      end
+
       it "should return nil when the catalog's environment doesn't match the agent specified environment" do
         Puppet[:environment] = 'second_env'
         configurer = Puppet::Configurer.new
@@ -922,23 +951,9 @@ describe Puppet::Configurer do
       expect(Puppet::Resource::Catalog.indirection).to receive(:find).and_return(apple, banana, banana)
 
       allow(Puppet).to receive(:notice)
-      allow(Puppet).to receive(:push_context)
       expect(Puppet).to receive(:notice).with("Local environment: 'production' doesn't match server specified environment 'apple', restarting agent run with environment 'apple'")
       expect(Puppet).to receive(:notice).with("Local environment: 'apple' doesn't match server specified environment 'banana', restarting agent run with environment 'banana'")
 
-      expect(Puppet).to receive(:push_context).with(
-        hash_including(current_environment: an_object_having_attributes(name: :production)),
-        'Local node environment production for configurer transaction'
-      )
-      expect(Puppet).to receive(:push_context).with(
-        hash_including(current_environment: an_object_having_attributes(name: :apple)),
-        'Local node environment apple for configurer transaction'
-      )
-      expect(Puppet).to receive(:push_context).with(
-        hash_including(current_environment: an_object_having_attributes(name: :banana)),
-        'Local node environment banana for configurer transaction'
-      )
-
       configurer.run
     end
 
@@ -1028,11 +1043,10 @@ describe Puppet::Configurer do
     it "should select a server when it receives 200 OK response" do
       Puppet.settings[:server_list] = ["myserver:123"]
 
-      stub_request(:get, 'https://myserver:123/status/v1/simple/master').to_return(status: 200)
+      stub_request(:get, 'https://myserver:123/status/v1/simple/server').to_return(status: 200)
 
       options = {}
       configurer.run(options)
-      expect(options[:report].master_used).to eq('myserver:123')
       expect(options[:report].server_used).to eq('myserver:123')
     end
 
@@ -1040,7 +1054,7 @@ describe Puppet::Configurer do
       Puppet.settings[:server_list] = ["myserver:123"]
       Puppet[:usecacheonfailure] = false
 
-      stub_request(:get, 'https://myserver:123/status/v1/simple/master').to_return(status: [500, "Internal Server Error"])
+      stub_request(:get, 'https://myserver:123/status/v1/simple/server').to_return(status: [500, "Internal Server Error"])
 
       expect {
         configurer.run
@@ -1053,189 +1067,40 @@ describe Puppet::Configurer do
       Puppet.settings[:server_list] = "myserver:123,someotherservername"
       Puppet[:usecacheonfailure] = false
 
-      stub_request(:get, 'https://myserver:123/status/v1/simple/master').to_return(status: 400)
-      stub_request(:get, 'https://someotherservername:8140/status/v1/simple/master').to_return(status: 400)
+      stub_request(:get, 'https://myserver:123/status/v1/simple/server').to_return(status: 400)
+      stub_request(:get, 'https://someotherservername:8140/status/v1/simple/server').to_return(status: 400)
 
       expect{
         configurer.run
       }.to raise_error(Puppet::Error, /Could not select a functional puppet server from server_list: 'myserver:123,someotherservername'/)
     end
 
-    it "should warn when servers in 'server_list' are unreachable" do
-      Puppet.settings[:server_list] = "mybadserver1:123,mybadserver2:123,mygoodserver"
-      Puppet[:usecacheonfailure] = false
-
-      stub_request(:get, 'https://mybadserver1:123/status/v1/simple/master').and_raise(Puppet::HTTP::HTTPError)
-      stub_request(:get, 'https://mybadserver2:123/status/v1/simple/master').and_raise(Puppet::HTTP::HTTPError)
-      stub_request(:get, 'https://mygoodserver:8140/status/v1/simple/master').to_return(status: 200)
-      
-      expect(Puppet).to receive(:warning).with(/^Unable to connect to server from server_list setting:.*Trying with next server from server_list.$/).twice
-      configurer.run
-    end
-
-    it "should warn when servers in 'server_list' respond with error" do
-      Puppet.settings[:server_list] = "mybadserver:123,someotherservername"
-      Puppet[:usecacheonfailure] = false
-
-      stub_request(:get, 'https://mybadserver:123/status/v1/simple/master').to_return(status: 400)
-      stub_request(:get, 'https://someotherservername:8140/status/v1/simple/master').to_return(status: 200)
-
-      expect(Puppet).to receive(:warning).with(/^Puppet server mybadserver:123 is unavailable: 400  Trying with next server from server_list.$/)
-      configurer.run
-    end
-
     it "should not error when usecacheonfailure is true and no servers in 'server_list' are reachable" do
       Puppet.settings[:server_list] = "myserver:123,someotherservername"
       Puppet[:usecacheonfailure] = true
 
-      stub_request(:get, 'https://myserver:123/status/v1/simple/master').to_return(status: 400)
-      stub_request(:get, 'https://someotherservername:8140/status/v1/simple/master').to_return(status: 400)
+      stub_request(:get, 'https://myserver:123/status/v1/simple/server').to_return(status: 400)
+      stub_request(:get, 'https://someotherservername:8140/status/v1/simple/server').to_return(status: 400)
 
       options = {}
 
       expect(configurer.run(options)).to eq(0)
       expect(options[:report].server_used).to be_nil
     end
-  end
-
-  describe "when selecting an environment" do
-    include PuppetSpec::Files
-    include PuppetSpec::Settings
-
-    describe "when the last used environment is available" do
-      let(:last_server_specified_environment) { 'development' }
-
-      before do
-        Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
-        ---
-        version:
-          config: 1624882680
-          puppet: 6.24.0
-        application:
-          initial_environment: #{Puppet[:environment]}
-          converged_environment: #{last_server_specified_environment}
-          run_mode: agent
-        SUMMARY
-      end
-
-      it "prefers the environment set via cli" do
-        Puppet.settings.handlearg('--environment', 'usethis')
-        configurer.run
-
-        expect(configurer.environment).to eq('usethis')
-      end
-
-      it "prefers the environment set via config" do
-        FileUtils.mkdir_p(Puppet[:confdir])
-        set_puppet_conf(Puppet[:confdir], <<~CONF)
-        [main]
-        environment = usethis
-        CONF
-
-        Puppet.initialize_settings
-        configurer.run
-
-        expect(configurer.environment).to eq('usethis')
-      end
-
-      it "uses environment from Puppet[:environment] if given a catalog" do
-        configurer.run(catalog: catalog)
-
-        expect(configurer.environment).to eq(Puppet[:environment])
-      end
-
-      it "uses environment from Puppet[:environment] if use_cached_catalog = true" do
-        Puppet[:use_cached_catalog] = true
-        expects_cached_catalog_only(catalog)
-        configurer.run
-
-        expect(configurer.environment).to eq(Puppet[:environment])
-      end
-
-      describe "when the environment is not set via CLI" do
-        it "uses the environment found in lastrunfile if the key exists" do
-          configurer.run
-
-          expect(configurer.environment).to eq(last_server_specified_environment)
-        end
-
-        it "pushes the converged environment found in lastrunfile over the existing context" do
-          initial_env = Puppet::Node::Environment.remote('production')
-          Puppet.push_context(
-            current_environment: initial_env,
-            loaders: Puppet::Pops::Loaders.new(initial_env, true))
-
-          expect(Puppet).to receive(:push_context).with(
-            hash_including(:current_environment, :loaders),
-            "Local node environment #{last_server_specified_environment} for configurer transaction"
-          ).once.and_call_original
 
-          configurer.run
-        end
-
-        it "uses environment from Puppet[:environment] if strict_environment_mode is set" do
-          Puppet[:strict_environment_mode] = true
-          configurer.run
-
-          expect(configurer.environment).to eq(Puppet[:environment])
-        end
-
-        it "uses environment from Puppet[:environment] if initial_environment is the same as converged_environment" do
-          Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
-          ---
-          version:
-            config: 1624882680
-            puppet: 6.24.0
-          application:
-            initial_environment: development
-            converged_environment: development
-            run_mode: agent
-          SUMMARY
-          configurer.run
-
-          expect(configurer.environment).to eq(Puppet[:environment])
-        end
-
-        it "uses environment from Puppet[:environment] if the run mode doesn't match" do
-          Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
-          ---
-          version:
-            config: 1624882680
-            puppet: 6.24.0
-          application:
-            initial_environment: #{Puppet[:environment]}
-            converged_environment: #{last_server_specified_environment}
-            run_mode: user
-          SUMMARY
-          configurer.run
-
-          expect(configurer.environment).to eq(Puppet[:environment])
-        end
-
-        it "uses environment from Puppet[:environment] if lastrunfile is invalid YAML" do
-          Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
-          Key: 'this is my very very very ' +
-               'long string'
-          SUMMARY
-          configurer.run
-
-          expect(configurer.environment).to eq(Puppet[:environment])
-        end
+    it "should not make multiple node requests when the server is found" do
+      Puppet.settings[:server_list] = ["myserver:123"]
 
-        it "uses environment from Puppet[:environment] if lastrunfile exists but is empty" do
-          Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', '')
-          configurer.run
+      Puppet::Node.indirection.terminus_class = :rest
+      Puppet::Resource::Catalog.indirection.terminus_class = :rest
 
-          expect(configurer.environment).to eq(Puppet[:environment])
-        end
+      stub_request(:get, 'https://myserver:123/status/v1/simple/server').to_return(status: 200)
+      stub_request(:post, %r{https://myserver:123/puppet/v3/catalog}).to_return(status: 200)
+      node_request = stub_request(:get, %r{https://myserver:123/puppet/v3/node/}).to_return(status: 200)
 
-        it "uses environment from Puppet[:environment] if the last used one cannot be found" do
-          Puppet[:lastrunfile] = tmpfile('last_run_summary.yaml')
-          configurer.run
+      configurer.run
 
-          expect(configurer.environment).to eq(Puppet[:environment])
-        end
-      end
+      expect(node_request).to have_been_requested.once
     end
   end
 end

data/spec/unit/confine/feature_spec.rb

@@ -22,7 +22,7 @@ describe Puppet::Confine::Feature do
     end
 
     it "should use the Puppet features instance to test validity" do
-      Puppet.features.add(:myfeature) do true end
+      expect(Puppet.features).to receive(:myfeature?)
       @confine.valid?
     end
 

data/spec/unit/confine_spec.rb

@@ -2,12 +2,6 @@ require 'spec_helper'
 
 require 'puppet/confine'
 
-class Puppet::TestConfine < Puppet::Confine
-  def pass?(value)
-    false
-  end
-end
-
 describe Puppet::Confine do
   it "should require a value" do
     expect { Puppet::Confine.new }.to raise_error(ArgumentError)
@@ -39,7 +33,7 @@ describe Puppet::Confine do
 
   describe "when testing all values" do
     before do
-      @confine = Puppet::TestConfine.new(%w{a b c})
+      @confine = Puppet::Confine.new(%w{a b c})
       @confine.label = "foo"
     end
 
@@ -70,7 +64,7 @@ describe Puppet::Confine do
   end
 
   describe "when testing the result of the values" do
-    before { @confine = Puppet::TestConfine.new(%w{a b c d}) }
+    before { @confine = Puppet::Confine.new(%w{a b c d}) }
 
     it "should return an array with the result of the test for each value" do
       allow(@confine).to receive(:pass?).and_return(true)

data/spec/unit/context/trusted_information_spec.rb

@@ -4,11 +4,7 @@ require 'puppet/certificate_factory'
 require 'puppet/context/trusted_information'
 
 describe Puppet::Context::TrustedInformation, :unless => RUBY_PLATFORM == 'java' do
-  let(:key) do
-    key = Puppet::SSL::Key.new("myname")
-    key.generate
-    key
-  end
+  let(:key) { OpenSSL::PKey::RSA.new(Puppet[:keylength]) }
 
   let(:csr) do
     csr = Puppet::SSL::CertificateRequest.new("csr")
@@ -26,7 +22,7 @@ describe Puppet::Context::TrustedInformation, :unless => RUBY_PLATFORM == 'java'
 
     # The cert must be signed so that it can be successfully be DER-decoded later
     signer = Puppet::SSL::CertificateSigner.new
-    signer.sign(cert.content, key.content)
+    signer.sign(cert.content, key)
     cert
   end
 

data/spec/unit/defaults_spec.rb

@@ -65,9 +65,9 @@ describe "Defaults" do
   end
 
   describe '.default_digest_algorithm' do
-    it 'defaults to md5 when FIPS is not enabled' do
+    it 'defaults to sha256 when FIPS is not enabled' do
       allow(Puppet::Util::Platform).to receive(:fips_enabled?).and_return(false)
-      expect(Puppet.default_digest_algorithm).to eq('md5')
+      expect(Puppet.default_digest_algorithm).to eq('sha256')
     end
 
     it 'defaults to sha256 when FIPS is enabled' do
@@ -77,9 +77,9 @@ describe "Defaults" do
   end
 
   describe '.supported_checksum_types' do
-    it 'defaults to md5, sha256, sha384, sha512, sha224 when FIPS is not enabled' do
+    it 'defaults to sha256, sha384, sha512, sha224, md5 when FIPS is not enabled' do
       allow(Puppet::Util::Platform).to receive(:fips_enabled?).and_return(false)
-      expect(Puppet.default_file_checksum_types).to eq(%w[md5 sha256 sha384 sha512 sha224])
+      expect(Puppet.default_file_checksum_types).to eq(%w[sha256 sha384 sha512 sha224 md5])
     end
 
     it 'defaults to sha256, sha384, sha512, sha224 when FIPS is enabled' do
@@ -89,8 +89,8 @@ describe "Defaults" do
   end
 
   describe 'Puppet[:supported_checksum_types]' do
-    it 'defaults to md5, sha256, sha512, sha384, sha224' do
-      expect(Puppet.settings[:supported_checksum_types]).to eq(%w[md5 sha256 sha384 sha512 sha224])
+    it 'defaults to sha256, sha512, sha384, sha224, md5' do
+      expect(Puppet.settings[:supported_checksum_types]).to eq(%w[sha256 sha384 sha512 sha224 md5])
     end
 
     it 'should raise an error on an unsupported checksum type' do
@@ -182,73 +182,86 @@ describe "Defaults" do
     end
   end
 
-  describe "facterng" do
-    it "defaults to false" do
-      expect(Puppet[:facterng]).to be_falsey
-    end
-
-    it "raises an exception if facter-ng could not be loaded" do
-      allow_any_instance_of(Puppet::Settings::BooleanSetting).to receive(:require).with('facter-ng').and_raise(LoadError)
-      allow(Facter).to receive(:value).with('facterversion').and_return('3.11.4')
+  describe "deprecated settings" do
+    it 'does not issue a deprecation warning by default' do
+      expect(Puppet).to receive(:deprecation_warning).never
 
-      expect{ Puppet.settings[:facterng] = true }.to raise_exception ArgumentError, 'facter-ng could not be loaded'
+      Puppet.initialize_settings
     end
+  end
 
-    context 'set logger' do
-      before do
-        @original_facter = Object.const_get(:Facter)
-
-        Object.send(:remove_const, :Facter)
-        facter = double('facter')
-        allow(facter).to receive(:on_message)
-        allow(facter).to receive(:value).with('facterversion').and_return('3.11.4')
-        Object.const_set(:Facter, facter)
-
-        allow_any_instance_of(Puppet::Settings::BooleanSetting).to receive(:require).with('facter-ng').and_return(true)
-        allow(Facter).to receive(:respond_to?).and_return(false)
-      end
-
-      after do
-        Object.const_set(:Facter, @original_facter)
-      end
+  describe "the call hook for the cadir setting", unless: Puppet::Util::Platform.windows? do
+    it 'does not warn when the cadir is outside the puppet ssldir' do
+      FileUtils.mkdir_p(Puppet[:confdir])
+      # This is fun; in order to get the confdir setting from the spec_helper to
+      # not be deleted by the #unsafe_clear in Puppet::Settings#parse_config,
+      # we can code it into the confdir itself, and thus we can avoid getting
+      # that setting wiped out during Puppet.initialize_settings.
+      File.write(File.join(Puppet[:confdir], 'puppet.conf'),
+                 "cadir = /my/cool/path/for/my/cadir\n
+                  confdir = #{Puppet[:confdir]}")
+      expect(Puppet).to_not receive(:log_ca_migration_warning)
+      Puppet.initialize_settings
+      expect(Puppet[:cadir]).to eq("/my/cool/path/for/my/cadir")
+    end
 
-      it 'calls setup_facter_logging!' do
-        allow(Puppet::Util::Logging).to receive(:setup_facter_logging!).and_return(true)
-        Puppet.settings[:facterng] = true
-        expect(Puppet::Util::Logging).to have_received(:setup_facter_logging!).once
+    it 'does warn when the cadir is inside the puppet ssldir' do
+      FileUtils.mkdir_p(Puppet[:confdir])
+      cadir_location = File.join(Puppet[:ssldir], 'still_inside_ssldir')
+      # This is fun; in order to get the confdir setting from the spec_helper to
+      # not be deleted by the #unsafe_clear in Puppet::Settings#parse_config,
+      # we can code it into the confdir itself, and thus we can avoid getting
+      # that setting wiped out during Puppet.initialize_settings.
+      File.write(File.join(Puppet[:confdir], 'puppet.conf'),
+                 "cadir = #{cadir_location}\n
+                  confdir = #{Puppet[:confdir]}")
+      expect(Puppet).to receive(:log_ca_migration_warning).twice
+      Puppet.initialize_settings
+      expect(Puppet[:cadir]).to eq(cadir_location)
       end
-    end
   end
 
-  describe "deprecated settings" do
-    it 'does not issue a deprecation warning by default' do
-      expect(Puppet).to receive(:deprecation_warning).never
-
+  describe "the default cadir", :unless => Puppet::Util::Platform.windows?  do
+    it 'defaults to the puppetserver confdir' do
       Puppet.initialize_settings
+      expect(Puppet[:cadir]).to eq('/etc/puppetlabs/puppetserver/ca')
     end
 
-    it 'issues a deprecation warning when func3x_check is disabled' do
-      Puppet[:func3x_check] = false
-
-      expect(Puppet).to receive(:deprecation_warning).with("The 'func3x_check' setting is deprecated and will be removed in a future release.")
-
+    it 'returns an empty string for Windows platforms', :if => Puppet::Util::Platform.windows? do
       Puppet.initialize_settings
+      expect(Puppet[:cadir]).to eq("")
     end
   end
 
-  describe "the default cadir", :unless => Puppet::Util::Platform.windows?  do
-    it 'defaults to inside the ssldir if not migrated' do
-      expect(File).to receive(:exist?).with('/etc/puppetlabs/puppetserver/ca/ca_crt.pem').and_return(false)
-      expect(Puppet.default_cadir).to eq("#{Puppet[:ssldir]}/ca")
+  describe '#default_cadir', :unless => Puppet::Util::Platform.windows?  do
+    it 'returns the new puppetserver directory when no ca dir is present' do
+      expect(Puppet).to_not receive(:log_ca_migration_warning)
+      expect(Puppet.default_cadir).to eq('/etc/puppetlabs/puppetserver/ca')
     end
 
-    it 'returns the new location if there is CA content there' do
-      expect(File).to receive(:exist?).with('/etc/puppetlabs/puppetserver/ca/ca_crt.pem').and_return(true)
-      expect(Puppet.default_cadir).to eq('/etc/puppetlabs/puppetserver/ca')
+    it 'warns when a CA dir exists in the current ssldir' do
+      cadir = File.join(Puppet[:ssldir], 'ca')
+      FileUtils.mkdir_p(cadir)
+      expect(Puppet).to receive(:log_ca_migration_warning)
+      expect(Puppet.default_cadir).to eq(cadir)
     end
 
-    it 'returns an empty string for Windows platforms', :if => Puppet::Util::Platform.windows? do
-      expect(Puppet.default_cadir).to eq("")
+    it 'warns when the cadir is a symlink still inside the ssldir' do
+      another_dir = File.join(Puppet[:ssldir], 'another_dir')
+      cadir = File.join(Puppet[:ssldir], 'ca')
+      FileUtils.mkdir_p(another_dir)
+      File.symlink(another_dir, cadir)
+      expect(Puppet).to receive(:log_ca_migration_warning)
+      expect(Puppet.default_cadir).to eq(another_dir)
+    end
+
+    it 'does not warn when the cadir is a symlink targeted outside the ssldir' do
+      another_dir = Dir.mktmpdir
+      cadir = File.join(Puppet[:ssldir], 'ca')
+      FileUtils.mkdir_p(Puppet[:ssldir])
+      File.symlink(another_dir, cadir)
+      expect(Puppet).to_not receive(:log_ca_migration_warning)
+      expect(Puppet.default_cadir).to eq(another_dir)
     end
   end
 end