puppet 6.29.0 → 7.0.0

data/install.rb

@@ -178,6 +178,9 @@ def prepare_installation
     opts.on('--vardir[=OPTIONAL]', 'Installation directory for var files', 'Default /opt/puppetlabs/puppet/cache') do |vardir|
       InstallOptions.vardir = vardir
     end
+    opts.on('--publicdir[=OPTIONAL]', 'Installation directory for public files such as the `last_run_summary.yaml` report', 'Default /opt/puppetlabs/puppet/public') do |publicdir|
+      InstallOptions.publicdir = publicdir
+    end
     opts.on('--rundir[=OPTIONAL]', 'Installation directory for state files', 'Default /var/run/puppetlabs') do |rundir|
       InstallOptions.rundir = rundir
     end
@@ -242,20 +245,10 @@ def prepare_installation
     $operatingsystem = Facter.value :operatingsystem
   end
 
-  if $operatingsystem == "windows"
-    begin
-      # populates constants used to specify default Windows directories
-      require 'win32/dir'
-    rescue LoadError => e
-      puts "Cannot run on Microsoft Windows without the win32-process, win32-dir & win32-service gems: #{e}"
-      exit(-1)
-    end
-  end
-
   if not InstallOptions.configdir.nil?
     configdir = InstallOptions.configdir
   elsif $operatingsystem == "windows"
-    configdir = File.join(Dir::COMMON_APPDATA, "PuppetLabs", "puppet", "etc")
+    configdir = File.join(ENV['ALLUSERSPROFILE'], "PuppetLabs", "puppet", "etc")
   else
     configdir = "/etc/puppetlabs/puppet"
   end
@@ -263,7 +256,7 @@ def prepare_installation
   if not InstallOptions.codedir.nil?
     codedir = InstallOptions.codedir
   elsif $operatingsystem == "windows"
-    codedir = File.join(Dir::COMMON_APPDATA, "PuppetLabs", "code")
+    codedir = File.join(ENV['ALLUSERSPROFILE'], "PuppetLabs", "code")
   else
     codedir = "/etc/puppetlabs/code"
   end
@@ -271,15 +264,23 @@ def prepare_installation
   if not InstallOptions.vardir.nil?
     vardir = InstallOptions.vardir
   elsif $operatingsystem == "windows"
-    vardir = File.join(Dir::COMMON_APPDATA, "PuppetLabs", "puppet", "cache")
+    vardir = File.join(ENV['ALLUSERSPROFILE'], "PuppetLabs", "puppet", "cache")
   else
     vardir = "/opt/puppetlabs/puppet/cache"
   end
 
+  if not InstallOptions.publicdir.nil?
+    publicdir = InstallOptions.publicdir
+  elsif $operatingsystem == "windows"
+    publicdir = File.join(ENV['ALLUSERSPROFILE'], "PuppetLabs", "puppet", "public")
+  else
+    publicdir = "/opt/puppetlabs/puppet/public"
+  end
+
   if not InstallOptions.rundir.nil?
     rundir = InstallOptions.rundir
   elsif $operatingsystem == "windows"
-    rundir = File.join(Dir::COMMON_APPDATA, "PuppetLabs", "puppet", "var", "run")
+    rundir = File.join(ENV['ALLUSERSPROFILE'], "PuppetLabs", "puppet", "var", "run")
   else
     rundir = "/var/run/puppetlabs"
   end
@@ -287,7 +288,7 @@ def prepare_installation
   if not InstallOptions.logdir.nil?
     logdir = InstallOptions.logdir
   elsif $operatingsystem == "windows"
-    logdir = File.join(Dir::COMMON_APPDATA, "PuppetLabs", "puppet", "var", "log")
+    logdir = File.join(ENV['ALLUSERSPROFILE'], "PuppetLabs", "puppet", "var", "log")
   else
     logdir = "/var/log/puppetlabs/puppet"
   end
@@ -302,7 +303,7 @@ def prepare_installation
     localedir = InstallOptions.localedir
   else
     if $operatingsystem == "windows"
-      localedir = File.join(Dir::PROGRAM_FILES, "Puppet Labs", "Puppet", "puppet", "share", "locale")
+      localedir = File.join(ENV['PROGRAMFILES'], "Puppet Labs", "Puppet", "puppet", "share", "locale")
     else
       localedir = "/opt/puppetlabs/puppet/share/locale"
     end
@@ -342,6 +343,7 @@ def prepare_installation
   configdir = join(destdir, configdir)
   codedir = join(destdir, codedir)
   vardir = join(destdir, vardir)
+  publicdir = join(destdir, publicdir)
   rundir = join(destdir, rundir)
   logdir = join(destdir, logdir)
   bindir = join(destdir, bindir)
@@ -355,6 +357,7 @@ def prepare_installation
   FileUtils.makedirs(mandir)
   FileUtils.makedirs(sitelibdir)
   FileUtils.makedirs(vardir)
+  FileUtils.makedirs(publicdir)
   FileUtils.makedirs(rundir)
   FileUtils.makedirs(logdir)
   FileUtils.makedirs(localedir)
@@ -366,6 +369,7 @@ def prepare_installation
   InstallOptions.lib_dir = libdir
   InstallOptions.man_dir = mandir
   InstallOptions.var_dir = vardir
+  InstallOptions.public_dir = publicdir
   InstallOptions.run_dir = rundir
   InstallOptions.log_dir = logdir
   InstallOptions.locale_dir = localedir
@@ -474,7 +478,7 @@ end
 # Change directory into the puppet root so we don't get the wrong files for install.
 FileUtils.cd File.dirname(__FILE__) do
   # Set these values to what you want installed.
-  configs = glob(%w{conf/auth.conf conf/puppet.conf conf/hiera.yaml})
+  configs = glob(%w{conf/puppet.conf conf/hiera.yaml})
   bins  = glob(%w{bin/*})
   #rdoc  = glob(%w{bin/* lib/**/*.rb README* }).reject { |e| e=~ /\.(bat|cmd)$/ }
   #ri    = glob(%w{bin/*.rb lib/**/*.rb}).reject { |e| e=~ /\.(bat|cmd)$/ }

data/lib/puppet/agent.rb

@@ -38,51 +38,26 @@ class Puppet::Agent
   # Perform a run with our client.
   def run(client_options = {})
     if disabled?
-      log_disabled_message
+      Puppet.notice _("Skipping run of %{client_class}; administratively disabled (Reason: '%{disable_message}');\nUse 'puppet agent --enable' to re-enable.") % { client_class: client_class, disable_message: disable_message }
       return
     end
 
     result = nil
     wait_for_lock_deadline = nil
     block_run = Puppet::Application.controlled_run do
-      # splay may sleep for awhile when running onetime! If not onetime, then
-      # the job scheduler splays (only once) so that agents assign themselves a
-      # slot within the splay interval.
-      do_splay = client_options.fetch(:splay, Puppet[:splay])
-      if do_splay
-        splay(do_splay)
-
-        if disabled?
-          log_disabled_message
-          break
-        end
-      end
-
-      # waiting for certs may sleep for awhile depending on onetime, waitforcert and maxwaitforcert!
-      # this needs to happen before forking so that if we fail to obtain certs and try to exit, then
-      # we exit the main process and not the forked child.
-      ssl_context = wait_for_certificates(client_options)
-
+      splay client_options.fetch :splay, Puppet[:splay]
       result = run_in_fork(should_fork) do
         with_client(client_options[:transaction_uuid], client_options[:job_id]) do |client|
           client_args = client_options.merge(:pluginsync => Puppet::Configurer.should_pluginsync?)
           begin
-            # lock may sleep for awhile depending on waitforlock and maxwaitforlock!
             lock do
-              if disabled?
-                log_disabled_message
-                nil
-              else
-                # NOTE: Timeout is pretty heinous as the location in which it
-                # throws an error is entirely unpredictable, which means that
-                # it can interrupt code blocks that perform cleanup or enforce
-                # sanity. The only thing a Puppet agent should do after this
-                # error is thrown is die with as much dignity as possible.
-                Timeout.timeout(Puppet[:runtimeout], RunTimeoutError) do
-                  Puppet.override(ssl_context: ssl_context) do
-                    client.run(client_args)
-                  end
-                end
+              # NOTE: Timeout is pretty heinous as the location in which it
+              # throws an error is entirely unpredictable, which means that
+              # it can interrupt code blocks that perform cleanup or enforce
+              # sanity. The only thing a Puppet agent should do after this
+              # error is thrown is die with as much dignity as possible.
+              Timeout.timeout(Puppet[:runtimeout], RunTimeoutError) do
+                client.run(client_args)
               end
             end
           rescue Puppet::LockError
@@ -103,13 +78,12 @@ class Puppet::Agent
             end
           rescue RunTimeoutError => detail
             Puppet.log_exception(detail, _("Execution of %{client_class} did not complete within %{runtimeout} seconds and was terminated.") %
-              {client_class: client_class, runtimeout: Puppet[:runtimeout]})
+              {client_class: client_class,
+              runtimeout: Puppet[:runtimeout]})
             nil
           rescue StandardError => detail
             Puppet.log_exception(detail, _("Could not run %{client_class}: %{detail}") % { client_class: client_class, detail: detail })
             nil
-          ensure
-            Puppet.runtime[:http].close
           end
         end
       end
@@ -163,14 +137,4 @@ class Puppet::Agent
   ensure
     @client = nil
   end
-
-  def wait_for_certificates(options)
-    waitforcert = options[:waitforcert] || (Puppet[:onetime] ? 0 : Puppet[:waitforcert])
-    sm = Puppet::SSL::StateMachine.new(waitforcert: waitforcert, onetime: Puppet[:onetime])
-    sm.ensure_client_certificate
-  end
-
-  def log_disabled_message
-    Puppet.notice _("Skipping run of %{client_class}; administratively disabled (Reason: '%{disable_message}');\nUse 'puppet agent --enable' to re-enable.") % { client_class: client_class, disable_message: disable_message }
-  end
 end

data/lib/puppet/application/agent.rb

@@ -133,12 +133,9 @@ Some flags are meant specifically for interactive use --- in particular,
 'test', 'tags' and 'fingerprint' are useful.
 
 '--test' runs once in the foreground with verbose logging, then exits.
-It also exits if it can't get a valid catalog. `--test` includes the 
-'--detailed-exitcodes' option by default and exits with one of the following 
-exit codes:
+It also exits if it can't get a valid catalog. `--test` includes the '--detailed-exitcodes' option by default and exits with one of the following exit codes:
 
-* 0: The run succeeded with no changes or failures; the system was already in 
-     the desired state.
+* 0: The run succeeded with no changes or failures; the system was already in the desired state.
 * 1: The run failed, or wasn't attempted due to another run already in progress.
 * 2: The run succeeded, and some resources were changed.
 * 4: The run succeeded, and some resources failed.
@@ -249,9 +246,7 @@ generated by running puppet agent with '--genconfig'.
   'puppet agent' exits after executing this.
   
 *  --evaltrace:
-  Logs each resource as it is being evaluated. This allows you to interactively
-  see exactly what is being done. (This is a Puppet setting, and can go in
-  puppet.conf. Note the special 'no-' prefix for boolean settings on the command line.)
+  Logs each resource as it is being evaluated. This allows you to interactively see exactly what is being done. (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-' prefix for boolean settings on the command line.)
 
 * --fingerprint:
   Display the current certificate or certificate signing request
@@ -272,8 +267,6 @@ generated by running puppet agent with '--genconfig'.
   service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
   file. If debugging or verbosity is enabled, this defaults to 'console'.
   Otherwise, it defaults to 'syslog' on POSIX systems and 'eventlog' on Windows.
-  Multiple destinations can be set using a comma separated list 
-  (eg: `/path/file1,console,/path/file2`)"
 
   A path ending with '.json' will receive structured output in JSON format. The
   log file will not have an ending ']' automatically written to it due to the
@@ -316,8 +309,7 @@ generated by running puppet agent with '--genconfig'.
   'no-splay', and 'show_diff'.
   
 * --trace
-  Prints stack traces on some errors. (This is a Puppet setting, and can go in
-  puppet.conf. Note the special 'no-' prefix for boolean settings on the command line.)
+  Prints stack traces on some errors. (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-' prefix for boolean settings on the command line.)
 
 * --verbose:
   Turn on verbose reporting.
@@ -334,10 +326,6 @@ generated by running puppet agent with '--genconfig'.
   specifying a time of 0.
   (This is a Puppet setting, and can go in puppet.conf.)
 
-* --write_catalog_summary
-  After compiling the catalog saves the resource list and classes list to the node
-  in the state directory named classes.txt and resources.txt
-  (This is a Puppet setting, and can go in puppet.conf.)
 
 EXAMPLE
 -------
@@ -383,11 +371,15 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
       log_config if Puppet[:daemonize]
 
+      # run ssl state machine, waiting if needed
+      ssl_context = wait_for_certificates
+
       # Each application is responsible for pushing loaders onto the context.
       # Use the current environment that has already been established, though
       # it may change later during the configurer run.
       env = Puppet.lookup(:current_environment)
-      Puppet.override(current_environment: env,
+      Puppet.override(ssl_context: ssl_context,
+                      current_environment: env,
                       loaders: Puppet::Pops::Loaders.new(env, true)) do
         if Puppet[:onetime]
           onetime(daemon)
@@ -430,7 +422,7 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
   def onetime(daemon)
     begin
-      exitstatus = daemon.agent.run({:job_id => options[:job_id], :start_time => options[:start_time], :waitforcert => options[:waitforcert]})
+      exitstatus = daemon.agent.run({:job_id => options[:job_id], :start_time => options[:start_time]})
     rescue => detail
       Puppet.log_exception(detail)
     end
@@ -520,4 +512,10 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
     daemon
   end
+
+  def wait_for_certificates
+    waitforcert = options[:waitforcert] || (Puppet[:onetime] ? 0 : Puppet[:waitforcert])
+    sm = Puppet::SSL::StateMachine.new(waitforcert: waitforcert)
+    sm.ensure_client_certificate
+  end
 end

data/lib/puppet/application/apply.rb

@@ -16,9 +16,7 @@ class Puppet::Application::Apply < Puppet::Application
   option("--use-nodes")
   option("--detailed-exitcodes")
 
-  option("--write-catalog-summary") do |arg|
-    Puppet[:write_catalog_summary] = arg
-  end
+  option("--write-catalog-summary")
 
   option("--catalog catalog",  "-c catalog") do |arg|
     options[:catalog] = arg
@@ -115,8 +113,6 @@ configuration options by running puppet with
   Where to send log messages. Choose between 'syslog' (the POSIX syslog
   service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
   file. Defaults to 'console'.
-  Multiple destinations can be set using a comma separated list
-  (eg: `/path/file1,console,/path/file2`)"
 
   A path ending with '.json' will receive structured output in JSON format. The
   log file will not have an ending ']' automatically written to it due to the
@@ -171,7 +167,6 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
   def app_defaults
     super.merge({
       :default_file_terminus => :file_server,
-      :write_catalog_summary => false
     })
   end
 
@@ -241,7 +236,7 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
         end
 
         # Resolve all deferred values and replace them / mutate the catalog
-        Puppet::Pops::Evaluator::DeferredResolver.resolve_and_replace(node.facts, catalog, apply_environment)
+        Puppet::Pops::Evaluator::DeferredResolver.resolve_and_replace(node.facts, catalog)
 
         # Translate it to a RAL catalog
         catalog = catalog.to_ral
@@ -250,22 +245,7 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
         catalog.retrieval_duration = Time.now - starttime
 
-        # We accept either the global option `--write_catalog_summary`
-        # corresponding to the new setting, or the application option
-        # `--write-catalog-summary`. The latter is needed to maintain backwards
-        # compatibility.
-        #
-        # Puppet settings parse global options using PuppetOptionParser, but it
-        # only recognizes underscores, not dashes.
-        # The base application parses app specific options using ruby's builtin
-        # OptionParser. As of ruby 2.4, it will accept either underscores or
-        # dashes, but prefer dashes.
-        #
-        # So if underscores are used, the PuppetOptionParser will parse it and
-        # store that in Puppet[:write_catalog_summary]. If dashes are used,
-        # OptionParser will parse it, and set Puppet[:write_catalog_summary]. In
-        # either case, settings will contain the correct value.
-        if Puppet[:write_catalog_summary]
+        if options[:write_catalog_summary]
           catalog.write_class_file
           catalog.write_resource_file
         end
@@ -350,7 +330,7 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
         raise Puppet::Error, _("Could not deserialize catalog from %{format}: %{detail}") % { format: format, detail: detail }, detail.backtrace
       end
       # Resolve all deferred values and replace them / mutate the catalog
-      Puppet::Pops::Evaluator::DeferredResolver.resolve_and_replace(node.facts, catalog, configured_environment)
+      Puppet::Pops::Evaluator::DeferredResolver.resolve_and_replace(node.facts, catalog)
 
       catalog.to_ral
     end

data/lib/puppet/application/device.rb

@@ -155,8 +155,6 @@ you can specify '--server <servername>' as an argument.
   Where to send log messages. Choose between 'syslog' (the POSIX syslog
   service), 'console', or the path to a log file. If debugging or verbosity is
   enabled, this defaults to 'console'. Otherwise, it defaults to 'syslog'.
-  Multiple destinations can be set using a comma separated list
-  (eg: `/path/file1,console,/path/file2`)"
 
   A path ending with '.json' will receive structured output in JSON format. The
   log file will not have an ending ']' automatically written to it due to the
@@ -261,119 +259,115 @@ Licensed under the Apache 2.0 License
         end
       end
       devices.collect do |devicename,device|
-        pool = Puppet.runtime[:http].pool
-        Puppet.override(:http_pool => pool) do
-          # TODO when we drop support for ruby < 2.5 we can remove the extra block here
-          begin
-            device_url = URI.parse(device.url)
-            # Handle nil scheme & port
-            scheme = "#{device_url.scheme}://" if device_url.scheme
-            port = ":#{device_url.port}" if device_url.port
-
-            # override local $vardir and $certname
-            Puppet[:ssldir] = ::File.join(Puppet[:deviceconfdir], device.name, 'ssl')
-            Puppet[:confdir] = ::File.join(Puppet[:devicedir], device.name)
-            Puppet[:libdir] = options[:libdir] || ::File.join(Puppet[:devicedir], device.name, 'lib')
-            Puppet[:vardir] = ::File.join(Puppet[:devicedir], device.name)
-            Puppet[:certname] = device.name
-            ssl_context = nil
-
-            # create device directory under $deviceconfdir
-            Puppet::FileSystem.dir_mkpath(Puppet[:ssldir]) unless Puppet::FileSystem.dir_exist?(Puppet[:ssldir])
-
-            # this will reload and recompute default settings and create device-specific sub vardir
-            Puppet.settings.use :main, :agent, :ssl
-
-            # Workaround for PUP-8736: store ssl certs outside the cache directory to prevent accidental removal and keep the old path as symlink
-            optssldir = File.join(Puppet[:confdir], 'ssl')
-            Puppet::FileSystem.symlink(Puppet[:ssldir], optssldir) unless Puppet::FileSystem.exist?(optssldir)
-
-            unless options[:resource] || options[:facts] || options[:apply]
-              # Since it's too complicated to fix properly in the default settings, we workaround for PUP-9642 here.
-              # See https://github.com/puppetlabs/puppet/pull/7483#issuecomment-483455997 for details.
-              # This has to happen after `settings.use` above, so the directory is created and before `setup_host` below, where the SSL
-              # routines would fail with access errors
-              if Puppet.features.root? && !Puppet::Util::Platform.windows?
-                user = Puppet::Type.type(:user).new(name: Puppet[:user]).exists? ? Puppet[:user] : nil
-                group = Puppet::Type.type(:group).new(name: Puppet[:group]).exists? ? Puppet[:group] : nil
-                Puppet.debug("Fixing perms for #{user}:#{group} on #{Puppet[:confdir]}")
-                FileUtils.chown(user, group, Puppet[:confdir]) if user || group
-              end
+        # TODO when we drop support for ruby < 2.5 we can remove the extra block here
+        begin
+          device_url = URI.parse(device.url)
+          # Handle nil scheme & port
+          scheme = "#{device_url.scheme}://" if device_url.scheme
+          port = ":#{device_url.port}" if device_url.port
+
+          # override local $vardir and $certname
+          Puppet[:ssldir] = ::File.join(Puppet[:deviceconfdir], device.name, 'ssl')
+          Puppet[:confdir] = ::File.join(Puppet[:devicedir], device.name)
+          Puppet[:libdir] = options[:libdir] || ::File.join(Puppet[:devicedir], device.name, 'lib')
+          Puppet[:vardir] = ::File.join(Puppet[:devicedir], device.name)
+          Puppet[:certname] = device.name
+          ssl_context = nil
+
+          # create device directory under $deviceconfdir
+          Puppet::FileSystem.dir_mkpath(Puppet[:ssldir]) unless Puppet::FileSystem.dir_exist?(Puppet[:ssldir])
+
+          # this will reload and recompute default settings and create device-specific sub vardir
+          Puppet.settings.use :main, :agent, :ssl
+
+          # Workaround for PUP-8736: store ssl certs outside the cache directory to prevent accidental removal and keep the old path as symlink
+          optssldir = File.join(Puppet[:confdir], 'ssl')
+          Puppet::FileSystem.symlink(Puppet[:ssldir], optssldir) unless Puppet::FileSystem.exist?(optssldir)
+
+          unless options[:resource] || options[:facts] || options[:apply]
+            # Since it's too complicated to fix properly in the default settings, we workaround for PUP-9642 here.
+            # See https://github.com/puppetlabs/puppet/pull/7483#issuecomment-483455997 for details.
+            # This has to happen after `settings.use` above, so the directory is created and before `setup_host` below, where the SSL
+            # routines would fail with access errors
+            if Puppet.features.root? && !Puppet::Util::Platform.windows?
+              user = Puppet::Type.type(:user).new(name: Puppet[:user]).exists? ? Puppet[:user] : nil
+              group = Puppet::Type.type(:group).new(name: Puppet[:group]).exists? ? Puppet[:group] : nil
+              Puppet.debug("Fixing perms for #{user}:#{group} on #{Puppet[:confdir]}")
+              FileUtils.chown(user, group, Puppet[:confdir]) if user || group
+            end
 
-              ssl_context = setup_context
+            ssl_context = setup_context
 
-              unless options[:libdir]
-                Puppet.override(ssl_context: ssl_context) do
-                  Puppet::Configurer::PluginHandler.new.download_plugins(env) if Puppet::Configurer.should_pluginsync?
-                end
+            unless options[:libdir]
+              Puppet.override(ssl_context: ssl_context) do
+                Puppet::Configurer::PluginHandler.new.download_plugins(env) if Puppet::Configurer.should_pluginsync?
               end
             end
+          end
 
-            # this inits the device singleton, so that the facts terminus
-            # and the various network_device provider can use it
-            Puppet::Util::NetworkDevice.init(device)
-
-            if options[:resource]
-              type, name = parse_args(command_line.args)
-              Puppet.info _("retrieving resource: %{resource} from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
-              resources = find_resources(type, name)
-              if options[:to_yaml]
-                data = resources.map do |resource|
-                  resource.prune_parameters(:parameters_to_include => @extra_params).to_hiera_hash
-                end.inject(:merge!)
-                text = YAML.dump(type.downcase => data)
-              else
-                text = resources.map do |resource|
-                  resource.prune_parameters(:parameters_to_include => @extra_params).to_manifest.force_encoding(Encoding.default_external)
-                end.join("\n")
-              end
-              (puts text)
-              0
-            elsif options[:facts]
-              Puppet.info _("retrieving facts from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
-              remote_facts = Puppet::Node::Facts.indirection.find(name, :environment => env)
-              # Give a proper name to the facts
-              remote_facts.name = remote_facts.values['clientcert']
-              renderer = Puppet::Network::FormatHandler.format(:console)
-              puts renderer.render(remote_facts)
-              0
-            elsif options[:apply]
-              # avoid reporting to server
-              Puppet::Transaction::Report.indirection.terminus_class = :yaml
-              Puppet::Resource::Catalog.indirection.cache_class = nil
-
-              require 'puppet/application/apply'
-              begin
-                Puppet[:node_terminus] = :plain
-                Puppet[:catalog_terminus] = :compiler
-                Puppet[:catalog_cache_terminus] = nil
-                Puppet[:facts_terminus] = :network_device
-                Puppet.override(:network_device => true) do
-                  Puppet::Application::Apply.new(Puppet::Util::CommandLine.new('puppet', ["apply", options[:apply]])).run_command
-                end
-              end
+          # this inits the device singleton, so that the facts terminus
+          # and the various network_device provider can use it
+          Puppet::Util::NetworkDevice.init(device)
+
+          if options[:resource]
+            type, name = parse_args(command_line.args)
+            Puppet.info _("retrieving resource: %{resource} from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+            resources = find_resources(type, name)
+            if options[:to_yaml]
+              data = resources.map do |resource|
+                resource.prune_parameters(:parameters_to_include => @extra_params).to_hiera_hash
+              end.inject(:merge!)
+              text = YAML.dump(type.downcase => data)
             else
-              Puppet.info _("starting applying configuration to %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
-
-              overrides = {}
-              overrides[:ssl_context] = ssl_context if ssl_context
-              Puppet.override(overrides) do
-                configurer = Puppet::Configurer.new
-                configurer.run(:network_device => true, :pluginsync => false)
+              text = resources.map do |resource|
+                resource.prune_parameters(:parameters_to_include => @extra_params).to_manifest.force_encoding(Encoding.default_external)
+              end.join("\n")
+            end
+            (puts text)
+            0
+          elsif options[:facts]
+            Puppet.info _("retrieving facts from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+            remote_facts = Puppet::Node::Facts.indirection.find(name, :environment => env)
+            # Give a proper name to the facts
+            remote_facts.name = remote_facts.values['clientcert']
+            renderer = Puppet::Network::FormatHandler.format(:console)
+            puts renderer.render(remote_facts)
+            0
+          elsif options[:apply]
+            # avoid reporting to server
+            Puppet::Transaction::Report.indirection.terminus_class = :yaml
+            Puppet::Resource::Catalog.indirection.cache_class = nil
+
+            require 'puppet/application/apply'
+            begin
+              Puppet[:node_terminus] = :plain
+              Puppet[:catalog_terminus] = :compiler
+              Puppet[:catalog_cache_terminus] = nil
+              Puppet[:facts_terminus] = :network_device
+              Puppet.override(:network_device => true) do
+                Puppet::Application::Apply.new(Puppet::Util::CommandLine.new('puppet', ["apply", options[:apply]])).run_command
               end
             end
-          rescue => detail
-            Puppet.log_exception(detail)
-            # If we rescued an error, then we return 1 as the exit code
-            1
-          ensure
-            pool.close
-            Puppet[:libdir] = libdir
-            Puppet[:vardir] = vardir
-            Puppet[:confdir] = confdir
-            Puppet[:ssldir] = ssldir
-            Puppet[:certname] = certname
+          else
+            Puppet.info _("starting applying configuration to %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+
+            overrides = {}
+            overrides[:ssl_context] = ssl_context if ssl_context
+            Puppet.override(overrides) do
+              configurer = Puppet::Configurer.new
+              configurer.run(:network_device => true, :pluginsync => false)
+            end
           end
+        rescue => detail
+          Puppet.log_exception(detail)
+          # If we rescued an error, then we return 1 as the exit code
+          1
+        ensure
+          Puppet[:libdir] = libdir
+          Puppet[:vardir] = vardir
+          Puppet[:confdir] = confdir
+          Puppet[:ssldir] = ssldir
+          Puppet[:certname] = certname
         end
       end
     end