puppet 7.8.0 → 7.12.0

data/spec/unit/configurer_spec.rb

@@ -7,6 +7,9 @@ describe Puppet::Configurer do
     Puppet[:report] = true
 
     catalog.add_resource(resource)
+    allow_any_instance_of(described_class).to(
+      receive(:valid_server_environment?).and_return(true)
+    )
   end
 
   let(:node_name) { Puppet[:node_name_value] }
@@ -78,10 +81,10 @@ describe Puppet::Configurer do
       configurer.run(:pluginsync => false)
     end
 
-    it "should carry on when it can't fetch its node definition" do
-      error = Net::HTTPError.new(400, 'dummy server communication error')
-      expect(Puppet::Node.indirection).to receive(:find).and_raise(error)
-      expect(configurer.run).to eq(0)
+    it "does not download plugins when specified environment is not vaild on server" do
+      expect(configurer).to receive(:valid_server_environment?).and_return(false)
+      expect(configurer).not_to receive(:download_plugins)
+      configurer.run(:pluginsync => true)
     end
 
     it "fails the run if pluginsync fails when usecacheonfailure is false" do
@@ -125,7 +128,6 @@ describe Puppet::Configurer do
     it "applies a cached catalog when it can't connect to the master" do
       error = Errno::ECONNREFUSED.new('Connection refused - connect(2)')
 
-      expect(Puppet::Node.indirection).to receive(:find).and_raise(error)
       expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(:ignore_cache => true)).and_raise(error)
       expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(:ignore_terminus => true)).and_return(catalog)
 
@@ -149,6 +151,126 @@ describe Puppet::Configurer do
       expect(report.host).to eq('node_name_from_fact')
     end
 
+    it "should warn the user when the fact value length limits are exceeded" do
+      Puppet[:fact_name_length_soft_limit] = 0
+      Puppet[:fact_value_length_soft_limit] = 1
+      Puppet[:top_level_facts_soft_limit] = 0
+      Puppet[:number_of_facts_soft_limit] = 0
+      Puppet[:payload_soft_limit] = 0
+
+      facts.values = { 'processors' => {
+        'cores' => 1,
+        'count' => 2,
+        'isa' => "i386",
+        'models' => [
+          "CPU1 @ 2.80GHz"
+        ],
+        'physicalcount' => 4 }
+      }
+      Puppet::Node::Facts.indirection.save(facts)
+
+      expect(Puppet).to receive(:warning).with(/Fact value '.+' with the value length: '[1-9]*' exceeds the value length limit: [1-9]*/).twice
+      configurer.run
+    end
+
+    it "should warn the user when the payload limits are exceeded" do
+      Puppet[:fact_name_length_soft_limit] = 0
+      Puppet[:fact_value_length_soft_limit] = 0
+      Puppet[:top_level_facts_soft_limit] = 0
+      Puppet[:number_of_facts_soft_limit] = 0
+      Puppet[:payload_soft_limit] = 1
+
+      facts.values = { 'processors' => {
+        'cores' => 1,
+        'count' => 2,
+        'isa' => "i386",
+        'models' => [
+          "CPU1 @ 2.80GHz"
+        ],
+        'physicalcount' => 4 }
+      }
+      Puppet::Node::Facts.indirection.save(facts)
+
+      expect(Puppet).to receive(:warning).with(/Payload with the current size of: '\d*' exceeds the payload size limit: \d*/)
+      configurer.run
+    end
+
+    it "should warn the user when the total number of facts limit is exceeded" do
+      Puppet[:fact_name_length_soft_limit] = 0
+      Puppet[:fact_value_length_soft_limit] = 0
+      Puppet[:top_level_facts_soft_limit] = 0
+      Puppet[:number_of_facts_soft_limit] = 1
+      Puppet[:payload_soft_limit] = 0
+
+      facts.values = { 
+        'processors' => {
+          'cores' => 1,
+          'count' => 2,
+          'isa' => "i386",
+          'models' => [
+            "CPU1 @ 2.80GHz",
+            "CPU1 @ 2.80GHz",
+            "CPU1 @ 2.80GHz",
+            "CPU1 @ 2.80GHz",
+            "CPU1 @ 2.80GHz",
+            { 
+              'processors' => {
+                'cores' => [1,2]
+              }
+            }
+          ],
+          'physicalcount' => 4 
+        }
+      }
+      Puppet::Node::Facts.indirection.save(facts)
+
+      expect(Puppet).to receive(:warning).with(/The current total number of facts: [1-9]* exceeds the number of facts limit: [1-9]*/)
+      configurer.run
+    end
+
+    it "should warn the user when the top level facts size limits are exceeded" do
+      Puppet[:fact_name_length_soft_limit] = 0
+      Puppet[:fact_value_length_soft_limit] = 0
+      Puppet[:top_level_facts_soft_limit] = 1
+      Puppet[:number_of_facts_soft_limit] = 0
+      Puppet[:payload_soft_limit] = 0
+
+      facts.values = {'my_new_fact_name' => 'my_new_fact_value',
+                      'my_new_fact_name2' => 'my_new_fact_value2'}
+      Puppet::Node::Facts.indirection.save(facts)
+
+      expect(Puppet).to receive(:warning).with(/The current number of top level facts: [1-9]* exceeds the top facts limit: [1-9]*/)
+      configurer.run
+    end
+
+    it "should warn the user when the fact name length limits are exceeded" do
+      Puppet[:fact_name_length_soft_limit] = 1
+      Puppet[:fact_value_length_soft_limit] = 0
+      Puppet[:top_level_facts_soft_limit] = 0
+      Puppet[:number_of_facts_soft_limit] = 0
+      Puppet[:payload_soft_limit] = 0
+
+      facts.values = {'my_new_fact_name' => 'my_new_fact_value'}
+      Puppet::Node::Facts.indirection.save(facts)
+
+      expect(Puppet).to receive(:warning).with(/Fact .+ with length: '[1-9]*' exceeds the length limit: [1-9]*/)
+      configurer.run
+    end
+
+    it "shouldn't warn the user when the fact limit settings are set to 0" do
+      Puppet[:fact_name_length_soft_limit] = 0
+      Puppet[:fact_value_length_soft_limit] = 0
+      Puppet[:top_level_facts_soft_limit] = 0
+      Puppet[:number_of_facts_soft_limit] = 0
+      Puppet[:payload_soft_limit] = 0
+
+      facts.values = {'my_new_fact_name' => 'my_new_fact_value'}
+      Puppet::Node::Facts.indirection.save(facts)
+
+      expect(Puppet).not_to receive(:warning)
+      configurer.run
+    end
+
     it "creates a new report when applying the catalog" do
       options = {}
       configurer.run(options)
@@ -461,7 +583,7 @@ describe Puppet::Configurer do
     it "should save the report if reporting is enabled" do
       Puppet.settings[:report] = true
 
-      expect(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, instance_of(Hash))
+      expect(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, instance_of(Hash)).twice
       configurer.send_report(report)
     end
 
@@ -489,12 +611,22 @@ describe Puppet::Configurer do
     it "should log but not fail if saving the report fails" do
       Puppet.settings[:report] = true
 
-      expect(Puppet::Transaction::Report.indirection).to receive(:save).and_raise("whatever")
+      expect(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, hash_including(ignore_cache: true)).and_raise("whatever")
+      expect(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, hash_including(ignore_terminus: true))
 
       configurer.send_report(report)
 
       expect(@logs).to include(an_object_having_attributes(level: :err, message: 'Could not send report: whatever'))
     end
+
+    it "should save the cached report if fails to send the report" do
+      allow(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, hash_including(ignore_terminus: true)).and_call_original
+      allow(Puppet::Transaction::Report.indirection).to receive(:save).with(report, nil, hash_including(ignore_cache: true)).and_raise("whatever")
+
+      expect(File).to_not be_exist(Puppet[:lastrunfile])
+      configurer.send_report(report)
+      expect(File.read(Puppet[:lastrunfile])).to match(/puppet: #{Puppet::PUPPETVERSION}/)
+    end
   end
 
   describe "when saving the summary report file" do
@@ -553,24 +685,6 @@ describe Puppet::Configurer do
     end
   end
 
-  describe "when requesting a node" do
-    it "uses the transaction uuid in the request" do
-      expect(Puppet::Node.indirection).to receive(:find).with(anything, hash_including(transaction_uuid: anything)).twice
-      configurer.run
-    end
-
-    it "sends an explicitly configured environment request" do
-      expect(Puppet.settings).to receive(:set_by_config?).with(:environment).and_return(true)
-      expect(Puppet::Node.indirection).to receive(:find).with(anything, hash_including(configured_environment: Puppet[:environment])).twice
-      configurer.run
-    end
-
-    it "does not send a configured_environment when using the default" do
-      expect(Puppet::Node.indirection).to receive(:find).with(anything, hash_including(configured_environment: nil)).twice
-      configurer.run
-    end
-  end
-
   def expects_pluginsync
     metadata = "[{\"path\":\"/etc/puppetlabs/code\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":0,\"group\":0,\"mode\":420,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-07-10 14:00:00 -0700\"},\"type\":\"directory\",\"destination\":null}]"
     stub_request(:get, %r{/puppet/v3/file_metadatas/(plugins|locales)}).to_return(status: 200, body: metadata, headers: {'Content-Type' => 'application/json'})
@@ -581,7 +695,7 @@ describe Puppet::Configurer do
   end
 
   def expects_new_catalog_only(catalog)
-    expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true)).and_return(catalog)
+    expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true, check_environment: true)).and_return(catalog)
     expect(Puppet::Resource::Catalog.indirection).not_to receive(:find).with(anything, hash_including(ignore_terminus: true))
   end
 
@@ -598,7 +712,7 @@ describe Puppet::Configurer do
   def expects_fallback_to_new_catalog(catalog)
     expects_pluginsync
     expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_terminus: true)).and_return(nil)
-    expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true)).and_return(catalog)
+    expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true, check_environment: true)).and_return(catalog)
   end
 
   def expects_neither_new_or_cached_catalog
@@ -622,21 +736,13 @@ describe Puppet::Configurer do
         configurer.run
       end
 
-      it "should not make a node request or pluginsync when a cached catalog is successfully retrieved" do
-        expect(Puppet::Node.indirection).not_to receive(:find)
+      it "should not pluginsync when a cached catalog is successfully retrieved" do
         expects_cached_catalog_only(catalog)
         expect(configurer).not_to receive(:download_plugins)
 
         configurer.run
       end
 
-      it "should make a node request and pluginsync when a cached catalog cannot be retrieved" do
-        expect(Puppet::Node.indirection).to receive(:find).and_return(nil)
-        expects_fallback_to_new_catalog(catalog)
-
-        configurer.run
-      end
-
       it "should set its cached_catalog_status to 'explicitly_requested'" do
         expects_cached_catalog_only(catalog)
 
@@ -672,7 +778,6 @@ describe Puppet::Configurer do
       it "should not attempt to retrieve a cached catalog again if the first attempt failed" do
         Puppet[:ignore_plugin_errors] = true
 
-        expect(Puppet::Node.indirection).to receive(:find).and_return(nil)
         expects_neither_new_or_cached_catalog
         expects_pluginsync
 
@@ -728,16 +833,6 @@ describe Puppet::Configurer do
         Puppet.settings[:strict_environment_mode] = true
       end
 
-      it "should not make a node request" do
-        stub_request(:get, %r{/puppet/v3/file_metadatas?/plugins}).to_return(:status => 404)
-        stub_request(:get, %r{/puppet/v3/file_metadatas?/pluginfacts}).to_return(:status => 404)
-        expects_new_catalog_only(catalog)
-
-        expect(Puppet::Node.indirection).not_to receive(:find)
-
-        configurer.run
-      end
-
       it "should return nil when the catalog's environment doesn't match the agent specified environment" do
         Puppet[:environment] = 'second_env'
         configurer = Puppet::Configurer.new
@@ -951,9 +1046,23 @@ describe Puppet::Configurer do
       expect(Puppet::Resource::Catalog.indirection).to receive(:find).and_return(apple, banana, banana)
 
       allow(Puppet).to receive(:notice)
+      allow(Puppet).to receive(:push_context)
       expect(Puppet).to receive(:notice).with("Local environment: 'production' doesn't match server specified environment 'apple', restarting agent run with environment 'apple'")
       expect(Puppet).to receive(:notice).with("Local environment: 'apple' doesn't match server specified environment 'banana', restarting agent run with environment 'banana'")
 
+      expect(Puppet).to receive(:push_context).with(
+        hash_including(current_environment: an_object_having_attributes(name: :production)),
+        'Local node environment production for configurer transaction'
+      )
+      expect(Puppet).to receive(:push_context).with(
+        hash_including(current_environment: an_object_having_attributes(name: :apple)),
+        'Local node environment apple for configurer transaction'
+      )
+      expect(Puppet).to receive(:push_context).with(
+        hash_including(current_environment: an_object_having_attributes(name: :banana)),
+        'Local node environment banana for configurer transaction'
+      )
+
       configurer.run
     end
 
@@ -1110,20 +1219,146 @@ describe Puppet::Configurer do
       expect(configurer.run(options)).to eq(0)
       expect(options[:report].server_used).to be_nil
     end
+  end
 
-    it "should not make multiple node requests when the server is found" do
-      Puppet.settings[:server_list] = ["myserver:123"]
+  describe "when selecting an environment" do
+    include PuppetSpec::Files
+    include PuppetSpec::Settings
 
-      Puppet::Node.indirection.terminus_class = :rest
-      Puppet::Resource::Catalog.indirection.terminus_class = :rest
+    describe "when the last used environment is available" do
+      let(:last_server_specified_environment) { 'development' }
 
-      stub_request(:get, 'https://myserver:123/status/v1/simple/server').to_return(status: 200)
-      stub_request(:post, %r{https://myserver:123/puppet/v3/catalog}).to_return(status: 200)
-      node_request = stub_request(:get, %r{https://myserver:123/puppet/v3/node/}).to_return(status: 200)
+      before do
+        Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
+        ---
+        version:
+          config: 1624882680
+          puppet: 6.24.0
+        application:
+          initial_environment: #{Puppet[:environment]}
+          converged_environment: #{last_server_specified_environment}
+          run_mode: agent
+        SUMMARY
+      end
 
-      configurer.run
+      it "prefers the environment set via cli" do
+        Puppet.settings.handlearg('--environment', 'usethis')
+        configurer.run
+
+        expect(configurer.environment).to eq('usethis')
+      end
+
+      it "prefers the environment set via config" do
+        FileUtils.mkdir_p(Puppet[:confdir])
+        set_puppet_conf(Puppet[:confdir], <<~CONF)
+        [main]
+        environment = usethis
+        CONF
+
+        Puppet.initialize_settings
+        configurer.run
+
+        expect(configurer.environment).to eq('usethis')
+      end
+
+      it "uses environment from Puppet[:environment] if given a catalog" do
+        configurer.run(catalog: catalog)
+
+        expect(configurer.environment).to eq(Puppet[:environment])
+      end
 
-      expect(node_request).to have_been_requested.once
+      it "uses environment from Puppet[:environment] if use_cached_catalog = true" do
+        Puppet[:use_cached_catalog] = true
+        expects_cached_catalog_only(catalog)
+        configurer.run
+
+        expect(configurer.environment).to eq(Puppet[:environment])
+      end
+
+      describe "when the environment is not set via CLI" do
+        it "uses the environment found in lastrunfile if the key exists" do
+          configurer.run
+
+          expect(configurer.environment).to eq(last_server_specified_environment)
+        end
+
+        it "pushes the converged environment found in lastrunfile over the existing context" do
+          initial_env = Puppet::Node::Environment.remote('production')
+          Puppet.push_context(
+            current_environment: initial_env,
+            loaders: Puppet::Pops::Loaders.new(initial_env, true))
+
+          expect(Puppet).to receive(:push_context).with(
+            hash_including(:current_environment, :loaders),
+            "Local node environment #{last_server_specified_environment} for configurer transaction"
+          ).once.and_call_original
+
+          configurer.run
+        end
+
+        it "uses environment from Puppet[:environment] if strict_environment_mode is set" do
+          Puppet[:strict_environment_mode] = true
+          configurer.run
+
+          expect(configurer.environment).to eq(Puppet[:environment])
+        end
+
+        it "uses environment from Puppet[:environment] if initial_environment is the same as converged_environment" do
+          Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
+          ---
+          version:
+            config: 1624882680
+            puppet: 6.24.0
+          application:
+            initial_environment: development
+            converged_environment: development
+            run_mode: agent
+          SUMMARY
+          configurer.run
+
+          expect(configurer.environment).to eq(Puppet[:environment])
+        end
+
+        it "uses environment from Puppet[:environment] if the run mode doesn't match" do
+          Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
+          ---
+          version:
+            config: 1624882680
+            puppet: 6.24.0
+          application:
+            initial_environment: #{Puppet[:environment]}
+            converged_environment: #{last_server_specified_environment}
+            run_mode: user
+          SUMMARY
+          configurer.run
+
+          expect(configurer.environment).to eq(Puppet[:environment])
+        end
+
+        it "uses environment from Puppet[:environment] if lastrunfile is invalid YAML" do
+          Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', <<~SUMMARY)
+          Key: 'this is my very very very ' +
+               'long string'
+          SUMMARY
+          configurer.run
+
+          expect(configurer.environment).to eq(Puppet[:environment])
+        end
+
+        it "uses environment from Puppet[:environment] if lastrunfile exists but is empty" do
+          Puppet[:lastrunfile] = file_containing('last_run_summary.yaml', '')
+          configurer.run
+
+          expect(configurer.environment).to eq(Puppet[:environment])
+        end
+
+        it "uses environment from Puppet[:environment] if the last used one cannot be found" do
+          Puppet[:lastrunfile] = tmpfile('last_run_summary.yaml')
+          configurer.run
+
+          expect(configurer.environment).to eq(Puppet[:environment])
+        end
+      end
     end
   end
 end

data/spec/unit/environments_spec.rb

@@ -5,6 +5,14 @@ require 'puppet/file_system'
 describe Puppet::Environments do
   FS = Puppet::FileSystem
 
+  module FsRemove
+    def remove
+      @properties[:directory?] = false
+      @properties[:exist?] = false
+      @properties[:executable?] = false
+    end
+  end
+
   before(:each) do
     Puppet.settings.initialize_global_settings
     Puppet[:environment_timeout] = "unlimited"
@@ -131,6 +139,14 @@ describe Puppet::Environments do
       end
     end
 
+    it "implements guard and unguard" do
+      loader_from(:filesystem => [directory_tree],
+                  :directory => directory_tree.children.first) do |loader|
+        expect(loader.guard('env1')).to be_nil
+        expect(loader.unguard('env1')).to be_nil
+      end
+    end
+
     context "with an environment.conf" do
       let(:envdir) do
         FS::MemoryFile.a_directory(File.expand_path("envdir"), [
@@ -607,6 +623,78 @@ config_version=$vardir/random/scripts
         cached.get(:cached)
       end
 
+      it "does not list deleted environments" do
+        env3 = FS::MemoryFile.a_directory("env3", [
+          FS::MemoryFile.a_regular_file_containing("environment.conf", '')
+        ])
+
+        envdir = FS::MemoryFile.a_directory(File.expand_path("envdir"), [
+          FS::MemoryFile.a_directory("env1", [
+            FS::MemoryFile.a_regular_file_containing("environment.conf", '')
+          ]),
+          FS::MemoryFile.a_directory("env2", [
+            FS::MemoryFile.a_regular_file_containing("environment.conf", '')
+          ]),
+          env3
+        ])
+
+        loader_from(:filesystem => [envdir], :directory => envdir) do |loader|
+          cached = Puppet::Environments::Cached.new(loader)
+          cached.get(:env1)
+          cached.get(:env2)
+          cached.get(:env3)
+          env3.extend(FsRemove).remove
+
+          expect(cached.list).to contain_exactly(environment(:env1),environment(:env2))
+          expect(cached.get(:env3)).to be_nil
+        end
+      end
+
+      it "normalizes environment name to symbol" do
+        env = Puppet::Node::Environment.create(:cached, [])
+        mocked_loader = double('loader')
+
+        expect(mocked_loader).not_to receive(:get).with('cached')
+        expect(mocked_loader).to receive(:get).with(:cached).and_return(env).once
+        expect(mocked_loader).to receive(:get_conf).with(:cached).and_return(Puppet::Settings::EnvironmentConf.static_for(env, 20)).once
+
+        cached = Puppet::Environments::Cached.new(mocked_loader)
+        cached.get('cached')
+        cached.get(:cached)
+      end
+
+      it "caches environment name as symbol and only once" do
+        mocked_loader = double('loader')
+
+        env = Puppet::Node::Environment.create(:cached, [])
+        allow(mocked_loader).to receive(:get).with(:cached).and_return(env)
+        allow(mocked_loader).to receive(:get_conf).with(:cached).and_return(Puppet::Settings::EnvironmentConf.static_for(env, 20))
+
+        cached = Puppet::Environments::Cached.new(mocked_loader)
+        cached.get(:cached)
+        cached.get('cached')
+
+        expect(cached.instance_variable_get(:@cache).keys).to eq([:cached])
+      end
+
+      it "is able to cache multiple environments" do
+        mocked_loader = double('loader')
+
+        env1 = Puppet::Node::Environment.create(:env1, [])
+        allow(mocked_loader).to receive(:get).with(:env1).and_return(env1)
+        allow(mocked_loader).to receive(:get_conf).with(:env1).and_return(Puppet::Settings::EnvironmentConf.static_for(env1, 20))
+
+        env2 = Puppet::Node::Environment.create(:env2, [])
+        allow(mocked_loader).to receive(:get).with(:env2).and_return(env2)
+        allow(mocked_loader).to receive(:get_conf).with(:env2).and_return(Puppet::Settings::EnvironmentConf.static_for(env2, 20))
+
+        cached = Puppet::Environments::Cached.new(mocked_loader)
+        cached.get('env1')
+        cached.get('env2')
+
+        expect(cached.instance_variable_get(:@cache).keys).to eq([:env1, :env2])
+      end
+
       it "returns nil if env not found" do
         cached_loader_from(:filesystem => [directory_tree], :directory => directory_tree.children.first) do |loader|
           expect(loader.get(:doesnotexist)).to be_nil
@@ -662,6 +750,17 @@ config_version=$vardir/random/scripts
         cached.get_conf(:cached)
       end
 
+      it "normalizes environment name to symbol" do
+        env = Puppet::Node::Environment.create(:cached, [])
+        mocked_loader = double('loader')
+        expect(mocked_loader).to receive(:get_conf).with(:cached).and_return(Puppet::Settings::EnvironmentConf.static_for(env, 20)).twice
+
+        cached = Puppet::Environments::Cached.new(mocked_loader)
+
+        cached.get_conf('cached')
+        cached.get_conf(:cached)
+      end
+
       it "returns nil if environment is not found" do
         cached_loader_from(:filesystem => [directory_tree], :directory => directory_tree.children.first) do |loader|
           expect(loader.get_conf(:doesnotexist)).to be_nil
@@ -751,6 +850,83 @@ config_version=$vardir/random/scripts
 
         expect(service.evicted_envs).to eq([:an_environment])
       end
+
+      context "when guarding an environment" do
+        before :each do
+          Puppet[:environment_timeout] = 0
+        end
+
+        let(:name) { :an_environment }
+
+        def with_guard(cached, name, &block)
+          cached.guard(name)
+          begin
+            yield
+          ensure
+            cached.unguard(name)
+          end
+        end
+
+        it "evicts an expired and unguarded environment" do
+          with_environment_loaded(service) do |cached|
+            cached.get!(name)
+          end
+
+          expect(service.created_envs).to eq([name, name])
+          expect(service.evicted_envs).to eq([name])
+        end
+
+        it "does not evict an expired, but guarded environment" do
+          with_environment_loaded(service) do |cached|
+            with_guard(cached, name) do
+              cached.get!(name) # these shouldn't reload
+              cached.get!(name)
+            end
+          end
+
+          expect(service.created_envs).to eq([name])
+          expect(service.evicted_envs).to eq([])
+        end
+
+        it "does not evict an environment marked for expiration, but is guarded" do
+          Puppet[:environment_timeout] = 'unlimited'
+
+          expect(service).to receive(:expired?).never
+
+          with_environment_loaded(service) do |cached|
+            with_guard(cached, name) do
+              cached.get!(name)
+            end
+          end
+
+          expect(service.created_envs).to eq([name])
+          expect(service.evicted_envs).to eq([])
+        end
+
+        it "evicts an environment that is no longer guarded" do
+          with_environment_loaded(service) do |cached|
+            with_guard(cached, name) {}
+
+            cached.get!(name) # this reloads
+          end
+
+          expect(service.created_envs).to eq([name, name])
+          expect(service.evicted_envs).to eq([name])
+        end
+
+        it "can nest guards" do
+          with_environment_loaded(service) do |cached|
+            with_guard(cached, name) do
+              with_guard(cached, name) do
+                cached.get!(name) # doesn't reload
+              end
+            end
+          end
+
+          expect(service.created_envs).to eq([name])
+          expect(service.evicted_envs).to eq([])
+        end
+      end
     end
 
     context '#clear' do
@@ -763,6 +939,14 @@ config_version=$vardir/random/scripts
 
         expect(service.evicted_envs).to eq([:an_environment])
       end
+
+      it "normalizes environment name to symbol" do
+        with_environment_loaded(service) do |cached|
+          cached.clear('an_environment')
+        end
+
+        expect(service.evicted_envs).to eq([:an_environment])
+      end
     end
 
     context '#clear_all' do